CVE-2024-45652

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-45652
IBM Maximo MXAPIASSET API 7.6.1.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.ibm.com/support/pages/node/7174820 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ibm:maximo_asset_management:7.6.1.3:*:*:*:*:*:*:*
History

18 Aug 2025, 17:56

Type Values Removed Values Added
CPE cpe:2.3:a:ibm:maximo_asset_management:7.6.1.3:*:*:*:*:*:*:*
Summary
  • (es) La API MXAPIASSET de IBM Maximo 7.6.1.3 podría permitir que un atacante remoto recorra directorios en sistema. Un atacante podría enviar una solicitud de URL manipulado especial que contenga secuencias de "punto punto" (/../) para ver archivos arbitrarios en el directorio sistema.
References () https://www.ibm.com/support/pages/node/7174820 - () https://www.ibm.com/support/pages/node/7174820 - Vendor Advisory
First Time Ibm
Ibm maximo Asset Management

19 Jan 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-19 03:15

Updated : 2025-08-18 17:56

NVD link : CVE-2024-45652

Mitre link : CVE-2024-45652

CVE.ORG link : CVE-2024-45652

JSON object : View

Products Affected

ibm

  • maximo_asset_management
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')