CVE-2019-4429

Published: Feb 19, 2020Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162886.

Affected (18)

Products: Ibm: Control Desk, Maximo Anywhere, Maximo For Aviation, Maximo For Life Sciences, Maximo For Nuclear Power, Maximo For Oil And Gas, Maximo For Transportation, Maximo For Utilities, Smartcloud Control Desk, Tivoli Integration Composer

10 products

Maximo For Life Sciences

Maximo For Nuclear Power

Maximo For Oil And Gas

Maximo For Transportation

Maximo For Utilities

Smartcloud Control Desk

Tivoli Integration Composer

Configuration A

18 vulnerable

Vulnerable Software	Affected Versions
Ibm Control Desk	Version 7.6.1.1
Ibm Control Desk	Version 7.6.1
Ibm Maximo Anywhere	Version 7.6.0.0
Ibm Maximo Anywhere	Version 7.6.1.0
Ibm Maximo For Aviation	Version 7.6.6
Ibm Maximo For Aviation	Version 7.6.7
Ibm Maximo For Aviation	Version 7.6.8
Ibm Maximo For Life Sciences	Version 7.6
Ibm Maximo For Nuclear Power	Version 7.6.1
Ibm Maximo For Oil And Gas	Version 7.6.1
Ibm Maximo For Transportation	Version 7.6.2.3
Ibm Maximo For Transportation	Version 7.6.2.4
Ibm Maximo For Transportation	Version 7.6.2.5
Ibm Maximo For Utilities	Version 7.6.0.1
Ibm Maximo For Utilities	Version 7.6.0.2
Ibm Smartcloud Control Desk	All versions
Ibm Tivoli Integration Composer	Version 7.6.0.1
Ibm Tivoli Integration Composer	Version 7.6.0.2