CVE-2023-32335

IBM Maximo Application Suite 8.10, 8.11 and IBM Maximo Asset Management 7.6.1.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 255075.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/266875	Vendor Advisory
https://www.ibm.com/support/pages/node/7138684	Vendor Advisory
https://www.ibm.com/support/pages/node/7138686	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/266875	Vendor Advisory
https://www.ibm.com/support/pages/node/7138684	Vendor Advisory
https://www.ibm.com/support/pages/node/7138686	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:maximo_application_suite:8.10:::::::*
	cpe:2.3:a:ibm:maximo_application_suite:8.11:::::::*
	cpe:2.3:a:ibm:maximo_asset_management:7.6.1.3:::::::*

History

14 Jan 2025, 20:10

Type	Values Removed	Values Added
First Time		Ibm maximo Application Suite Ibm Ibm maximo Asset Management
CWE		NVD-CWE-Other
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/266875 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/266875 - Vendor Advisory
References	~~() https://www.ibm.com/support/pages/node/7138684 -~~	() https://www.ibm.com/support/pages/node/7138684 - Vendor Advisory
References	~~() https://www.ibm.com/support/pages/node/7138686 -~~	() https://www.ibm.com/support/pages/node/7138686 - Vendor Advisory
CPE		cpe:2.3:a:ibm:maximo_application_suite:8.11:::::::* cpe:2.3:a:ibm:maximo_application_suite:8.10:::::::* cpe:2.3:a:ibm:maximo_asset_management:7.6.1.3:::::::*

Information

Published : 2024-03-13 10:15

Updated : 2025-01-14 20:10

NVD link : CVE-2023-32335

Mitre link : CVE-2023-32335

CVE.ORG link : CVE-2023-32335

JSON object : View

Products Affected

ibm

maximo_application_suite
maximo_asset_management

CWE

CWE-598

Use of GET Request Method With Sensitive Query Strings

NVD-CWE-Other

{"id": "CVE-2023-32335", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-03-13T10:15:07.413", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/266875", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/7138684", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/7138686", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/266875", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.ibm.com/support/pages/node/7138684", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.ibm.com/support/pages/node/7138686", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-598"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "IBM Maximo Application Suite 8.10, 8.11 and IBM Maximo Asset Management 7.6.1.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 255075."}, {"lang": "es", "value": "IBM Maximo Application Suite 8.10, 8.11 e IBM Maximo Asset Management 7.6.1.3 almacenan informaci\u00f3n confidencial en par\u00e1metros de URL. Esto puede dar lugar a la divulgaci\u00f3n de informaci\u00f3n si partes no autorizadas tienen acceso a las URL a trav\u00e9s de los registros del servidor, el encabezado de referencia o el historial del navegador. ID de IBM X-Force: 255075."}], "lastModified": "2025-01-14T20:10:32.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD9CA1C5-A903-4002-B9D3-430412676544"}, {"criteria": "cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB312A14-314B-4AD0-941C-A6AE1EC0D592"}, {"criteria": "cpe:2.3:a:ibm:maximo_asset_management:7.6.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0279056-1BD2-4CD6-86BA-DDAA6AB53C6F"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}