CVE-2012-3328

Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1, Maximo Asset Management Essentials 7.1, Tivoli Asset Management for IT 7.1 and 7.2, Tivoli Service Request Manager 7.1 and 7.2, and Change and Configuration Management Database (CCMDB) 7.1 and 7.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to a hidden frame footer.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg1IV20823
http://www-01.ibm.com/support/docview.wss?uid=swg21625624	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/78040
http://www-01.ibm.com/support/docview.wss?uid=swg1IV20823
http://www-01.ibm.com/support/docview.wss?uid=swg21625624	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/78040

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:change_and_configuration_management_database:7.1.:::::::*
	cpe:2.3:a:ibm:change_and_configuration_management_database:7.2.0:::::::*
	cpe:2.3:a:ibm:maximo_asset_management:7.1:::::::*
	cpe:2.3:a:ibm:maximo_asset_management_essentials:7.1:::::::*
	cpe:2.3:a:ibm:tivoli_asset_management_for_it:7.1:::::::*
	cpe:2.3:a:ibm:tivoli_asset_management_for_it:7.2:::::::*
	cpe:2.3:a:ibm:tivoli_service_request_manager:7.1.0:::::::*
	cpe:2.3:a:ibm:tivoli_service_request_manager:7.1.0.0:::::::*
	cpe:2.3:a:ibm:tivoli_service_request_manager:7.2.0.0:::::::*

History

No history.

Information

Published : 2013-02-20 12:09

Updated : 2025-04-11 00:51

NVD link : CVE-2012-3328

Mitre link : CVE-2012-3328

CVE.ORG link : CVE-2012-3328

JSON object : View

Products Affected

ibm

tivoli_service_request_manager
maximo_asset_management
tivoli_asset_management_for_it
maximo_asset_management_essentials
change_and_configuration_management_database

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2012-3328", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2013-02-20T12:09:22.037", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV20823", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21625624", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78040", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV20823", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21625624", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78040", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1, Maximo Asset Management Essentials 7.1, Tivoli Asset Management for IT 7.1 and 7.2, Tivoli Service Request Manager 7.1 and 7.2, and Change and Configuration Management Database (CCMDB) 7.1 and 7.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to a hidden frame footer."}, {"lang": "es", "value": "Vulnerabilidad XSS en IBM Maximo Asset Management v7.1, Maximo Asset Management Essentials v7.1, Tivoli Asset Management para IT v7.1 y v7.2, Tivoli Service Request Manager v7.1 y v7.2, y Change y Configuration Management Database (CCMDB) v7.1 v 7.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de vectores que involucran a un marco (frame) oculto en el pie."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:change_and_configuration_management_database:7.1.:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13CD271A-72E0-4730-A936-87B5122D9E3D"}, {"criteria": "cpe:2.3:a:ibm:change_and_configuration_management_database:7.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2446CA6E-D316-4239-8FDC-436643EB35EA"}, {"criteria": "cpe:2.3:a:ibm:maximo_asset_management:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE721CF9-0F75-410B-A0F4-542041E25925"}, {"criteria": "cpe:2.3:a:ibm:maximo_asset_management_essentials:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85457F6C-80FE-4E9F-BAB6-58B0485D8B7B"}, {"criteria": "cpe:2.3:a:ibm:tivoli_asset_management_for_it:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "013D299A-6A9C-44C7-B49C-A4115F4C13E3"}, {"criteria": "cpe:2.3:a:ibm:tivoli_asset_management_for_it:7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D5C1BCF-1DC0-45E7-B624-9221F8610346"}, {"criteria": "cpe:2.3:a:ibm:tivoli_service_request_manager:7.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54234F72-760A-4E80-8172-1AD93F0A372B"}, {"criteria": "cpe:2.3:a:ibm:tivoli_service_request_manager:7.1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1EE7E44-638B-4B42-88F3-F8E4019D8287"}, {"criteria": "cpe:2.3:a:ibm:tivoli_service_request_manager:7.2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED3A0A74-83FB-4061-8232-4BAA9D901B75"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}