CVE-2024-45077

{"id": "CVE-2024-45077", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-01-24T16:15:36.903", "references": [{"url": "https://www.ibm.com/support/pages/node/7174819", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-98"}]}], "descriptions": [{"lang": "en", "value": "IBM Maximo Asset Management 7.6.1.3 MXAPIASSET API is vulnerable to unrestricted file upload which allows authenticated low privileged user to upload restricted file types with a simple method of adding a dot to the end of the file name if Maximo is installed on Windows operating system."}, {"lang": "es", "value": "La API MXAPIASSET de IBM Maximo Asset Management 7.6.1.3 es vulnerable a la carga de archivos sin restricciones, lo que permite que usuarios autenticados con pocos privilegios carguen tipos de archivos restringidos con un m\u00e9todo simple de agregar un punto al final del nombre del archivo si Maximo est\u00e1 instalado en el sistema operativo Windows sistema."}], "lastModified": "2025-08-14T15:18:56.307", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:maximo_asset_management:7.6.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0279056-1BD2-4CD6-86BA-DDAA6AB53C6F"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}