| タイトル | 複数の IBM 製品におけるアクセス制限を回避される脆弱性 |
|---|---|
| 概要 | IBM Maximo Asset Management、SmartCloud Control Desk、Tivoli Asset Management for IT および特定のその他の製品には、アクセス制限を回避され、ログインセッションを確立される脆弱性が存在します。 補足情報 : CWE による脆弱性タイプは、CWE-284: Improper Access Control (不適切なアクセス制御) と識別されています。 http://cwe.mitre.org/data/definitions/284.html |
| 想定される影響 | リモート認証されたユーザにより、期限切れのパスワードを入力されることで、アクセス制限を回避され、ログインセッションを確立される可能性があります。 |
| 対策 | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| 公表日 | 2015年10月19日0:00 |
| 登録日 | 2016年1月8日16:25 |
| 最終更新日 | 2016年1月8日16:25 |
| CVSS2.0 : 警告 | |
| スコア | 5.5 |
|---|---|
| ベクター | AV:N/AC:L/Au:S/C:P/I:P/A:N |
| IBM |
| IBM Maximo Asset Management 7.1 |
| IBM Maximo Asset Management 7.5 |
| IBM Maximo Asset Management 7.6 |
| IBM Maximo Asset Management 7.1 |
| IBM Maximo Asset Management 7.5 |
| IBM Maximo Asset Management 7.6 |
| IBM Maximo Asset Management Essentials 7.1 |
| IBM Maximo Asset Management Essentials 7.5 |
| IBM Maximo Asset Management Essentials 7.1 |
| IBM Maximo Asset Management Essentials 7.5 |
| IBM Maximo for Energy Optimization 7.1 |
| IBM Maximo for Energy Optimization 7.1 |
| IBM Maximo for Government 7.1 |
| IBM Maximo for Government 7.5 |
| IBM Maximo for Government 7.1 |
| IBM Maximo for Government 7.5 |
| IBM Maximo for Life Sciences 7.1 |
| IBM Maximo for Life Sciences 7.5 |
| IBM Maximo for Life Sciences 7.6 |
| IBM Maximo for Life Sciences 7.1 |
| IBM Maximo for Life Sciences 7.5 |
| IBM Maximo for Life Sciences 7.6 |
| IBM Maximo for Nuclear Power 7.1 |
| IBM Maximo for Nuclear Power 7.5 |
| IBM Maximo for Nuclear Power 7.1 |
| IBM Maximo for Nuclear Power 7.5 |
| IBM Maximo for Oil and Gas 7.1 |
| IBM Maximo for Oil and Gas 7.5 |
| IBM Maximo for Oil and Gas 7.1 |
| IBM Maximo for Oil and Gas 7.5 |
| IBM Maximo for Transportation 7.1 |
| IBM Maximo for Transportation 7.5 |
| IBM Maximo for Transportation 7.1 |
| IBM Maximo for Transportation 7.5 |
| IBM Maximo for Utilities 7.1 |
| IBM Maximo for Utilities 7.5 |
| IBM Maximo for Utilities 7.1 |
| IBM Maximo for Utilities 7.5 |
| IBM SmartCloud Control Desk 7.5 |
| IBM SmartCloud Control Desk 7.6 |
| IBM SmartCloud Control Desk 7.5 |
| IBM SmartCloud Control Desk 7.6 |
| Tivoli Asset Management for IT 7.1 |
| Tivoli Asset Management for IT 7.2 |
| Tivoli Asset Management for IT 7.1 |
| Tivoli Asset Management for IT 7.2 |
| Tivoli Change and Configuration Management Database 7.1 |
| Tivoli Change and Configuration Management Database 7.2 |
| Tivoli Change and Configuration Management Database 7.1 |
| Tivoli Change and Configuration Management Database 7.2 |
| Tivoli Service Request Manager 7.1 |
| Tivoli Service Request Manager 7.2 |
| Tivoli Service Request Manager 7.1 |
| Tivoli Service Request Manager 7.2 |
| No | 変更内容 | 変更日 |
|---|---|---|
| 0 | [2016年01月08日] 掲載 |
2018年2月17日10:37 |
| 概要 | IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 IFIX002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and 7.6.0 before 7.6.0.2 IFIX002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allow remote authenticated users to bypass intended access restrictions and establish a login session by entering an expired password. |
|---|---|
| 公表日 | 2016年1月3日14:59 |
| 登録日 | 2021年1月26日14:51 |
| 最終更新日 | 2024年11月21日11:32 |
| 構成1 | 以上 | 以下 | より上 | 未満 | |
| cpe:2.3:a:ibm:maximo_for_transportation:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_utilities:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_utilities:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_nuclear_power:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:tivoli_service_request_manager:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_asset_management:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:smartcloud_control_desk:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_life_sciences:7.6:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:smartcloud_control_desk:7.6:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:change_and_configuration_management_database:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_asset_management_essentials:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:tivoli_asset_management_for_it:7.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_asset_management:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_oil_and_gas:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_government:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:change_and_configuration_management_database:7.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_energy_optimization:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_life_sciences:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:tivoli_asset_management_for_it:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_nuclear_power:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_government:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_asset_management:7.6:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_life_sciences:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:tivoli_service_request_manager:7.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_oil_and_gas:7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_for_transportation:7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:maximo_asset_management_essentials:7.1:*:*:*:*:*:*:* | |||||