| Title | 複数の IBM 製品におけるアクセス制限を回避される脆弱性 |
|---|---|
| Summary | IBM Maximo Asset Management、SmartCloud Control Desk、Tivoli Asset Management for IT および特定のその他の製品には、アクセス制限を回避され、ログインセッションを確立される脆弱性が存在します。 補足情報 : CWE による脆弱性タイプは、CWE-284: Improper Access Control (不適切なアクセス制御) と識別されています。 http://cwe.mitre.org/data/definitions/284.html |
| Possible impacts | リモート認証されたユーザにより、期限切れのパスワードを入力されることで、アクセス制限を回避され、ログインセッションを確立される可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | Oct. 19, 2015, midnight |
| Registration Date | Jan. 8, 2016, 4:25 p.m. |
| Last Update | Jan. 8, 2016, 4:25 p.m. |
| CVSS2.0 : 警告 | |
| Score | 5.5 |
|---|---|
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:N |
| IBM |
| IBM Maximo Asset Management 7.1 |
| IBM Maximo Asset Management 7.5 |
| IBM Maximo Asset Management 7.6 |
| IBM Maximo Asset Management 7.1 |
| IBM Maximo Asset Management 7.5 |
| IBM Maximo Asset Management 7.6 |
| IBM Maximo Asset Management Essentials 7.1 |
| IBM Maximo Asset Management Essentials 7.5 |
| IBM Maximo Asset Management Essentials 7.1 |
| IBM Maximo Asset Management Essentials 7.5 |
| IBM Maximo for Energy Optimization 7.1 |
| IBM Maximo for Energy Optimization 7.1 |
| IBM Maximo for Government 7.1 |
| IBM Maximo for Government 7.5 |
| IBM Maximo for Government 7.1 |
| IBM Maximo for Government 7.5 |
| IBM Maximo for Life Sciences 7.1 |
| IBM Maximo for Life Sciences 7.5 |
| IBM Maximo for Life Sciences 7.6 |
| IBM Maximo for Life Sciences 7.1 |
| IBM Maximo for Life Sciences 7.5 |
| IBM Maximo for Life Sciences 7.6 |
| IBM Maximo for Nuclear Power 7.1 |
| IBM Maximo for Nuclear Power 7.5 |
| IBM Maximo for Nuclear Power 7.1 |
| IBM Maximo for Nuclear Power 7.5 |
| IBM Maximo for Oil and Gas 7.1 |
| IBM Maximo for Oil and Gas 7.5 |
| IBM Maximo for Oil and Gas 7.1 |
| IBM Maximo for Oil and Gas 7.5 |
| IBM Maximo for Transportation 7.1 |
| IBM Maximo for Transportation 7.5 |
| IBM Maximo for Transportation 7.1 |
| IBM Maximo for Transportation 7.5 |
| IBM Maximo for Utilities 7.1 |
| IBM Maximo for Utilities 7.5 |
| IBM Maximo for Utilities 7.1 |
| IBM Maximo for Utilities 7.5 |
| IBM SmartCloud Control Desk 7.5 |
| IBM SmartCloud Control Desk 7.6 |
| IBM SmartCloud Control Desk 7.5 |
| IBM SmartCloud Control Desk 7.6 |
| Tivoli Asset Management for IT 7.1 |
| Tivoli Asset Management for IT 7.2 |
| Tivoli Asset Management for IT 7.1 |
| Tivoli Asset Management for IT 7.2 |
| Tivoli Change and Configuration Management Database 7.1 |
| Tivoli Change and Configuration Management Database 7.2 |
| Tivoli Change and Configuration Management Database 7.1 |
| Tivoli Change and Configuration Management Database 7.2 |
| Tivoli Service Request Manager 7.1 |
| Tivoli Service Request Manager 7.2 |
| Tivoli Service Request Manager 7.1 |
| Tivoli Service Request Manager 7.2 |
| No | Changed Details | Date of change |
|---|---|---|
| 0 | [2016年01月08日] 掲載 |
Feb. 17, 2018, 10:37 a.m. |
| Summary | IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 IFIX002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and 7.6.0 before 7.6.0.2 IFIX002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allow remote authenticated users to bypass intended access restrictions and establish a login session by entering an expired password. |
|---|---|
| Publication Date | Jan. 3, 2016, 2:59 p.m. |
| Registration Date | Jan. 26, 2021, 2:51 p.m. |
| Last Update | Nov. 21, 2024, 11:32 a.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:ibm:maximo_for_transportation:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_utilities:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_utilities:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_nuclear_power:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:tivoli_service_request_manager:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_asset_management:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:smartcloud_control_desk:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_life_sciences:7.6:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:smartcloud_control_desk:7.6:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:change_and_configuration_management_database:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_asset_management_essentials:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:tivoli_asset_management_for_it:7.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_asset_management:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_oil_and_gas:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_government:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:change_and_configuration_management_database:7.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_energy_optimization:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_life_sciences:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:tivoli_asset_management_for_it:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_nuclear_power:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_government:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_asset_management:7.6:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_life_sciences:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:tivoli_service_request_manager:7.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_oil_and_gas:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_transportation:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_asset_management_essentials:7.1:*:*:*:*:*:*:* | |||||