CVE-2020-4463

IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data

High · published July 29, 2020

CVSS v3.0
8.2
EPSS
32%
Percentile
98.3
In the wild
Unconfirmed
What it is

IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181484.

The record
Technical detail
CVSS v3.0
8.2 · HIGH
Vector
CVSS:3.0/S:U/PR:N/UI:N/AV:N/I:N/C:H/AC:L/A:L/RL:O/RC:C/E:U
CVSS v4.0
Not supplied
EPSS
0.31590 · 98.3th percentile
Published
2020-07-29T14:05Z
EPSS history
Timeline
  • 29 JUL 14:05Z
    IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data
    cvelistv5