CVE-2019-4303

Published: Jun 19, 2019Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 160949.

Affected (20)

Products: Ibm: Maximo Asset Management, Control Desk, Maximo For Aviation, Maximo For Life Sciences, Maximo For Nuclear Power, Maximo For Oil And Gas, Maximo For Transportation, Maximo For Utilities, Smartcloud Control Desk, Tivoli Integration Composer

Ibm

10 products

Maximo Asset Management

Control Desk

Maximo For Aviation

Maximo For Life Sciences

Maximo For Nuclear Power

Maximo For Oil And Gas

Maximo For Transportation

Maximo For Utilities

Smartcloud Control Desk

Tivoli Integration Composer

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ibm Maximo Asset Management	Version 7.6

Configuration B

19 vulnerable

Vulnerable Software	Affected Versions
Ibm Control Desk	Version 7.6.0.1
Ibm Control Desk	Version 7.6.0
Ibm Maximo For Aviation	Version 7.6.1
Ibm Maximo For Aviation	Version 7.6.2.1
Ibm Maximo For Aviation	Version 7.6.2
Ibm Maximo For Aviation	Version 7.6.3
Ibm Maximo For Aviation	Version 7.6
Ibm Maximo For Life Sciences	Version 7.6
Ibm Maximo For Nuclear Power	Version 7.6.0
Ibm Maximo For Oil And Gas	Version 7.6.0
Ibm Maximo For Transportation	Version 7.6.1
Ibm Maximo For Transportation	Version 7.6.2.1
Ibm Maximo For Transportation	Version 7.6.2.2
Ibm Maximo For Transportation	Version 7.6.2.3
Ibm Maximo For Transportation	Version 7.6.2.4
Ibm Maximo For Transportation	Version 7.6.2
Ibm Maximo For Utilities	Version 7.6
Ibm Smartcloud Control Desk	All versions
Ibm Tivoli Integration Composer	All versions