CVE-2024-45077CWE-98

IBM Maximo Asset Management file upload

Medium · published January 24, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

IBM Maximo Asset Management 7.6.1.3 MXAPIASSET API is vulnerable to unrestricted file upload which allows authenticated low privileged user to upload restricted file types with a simple method of adding a dot to the end of the file name if Maximo is installed on Windows operating system.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00345 · 26.7th percentile
Weakness
CWE-98 · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Published
2025-01-24T15:38Z
EPSS history
Timeline
  • 24 JAN 15:38Z
    IBM Maximo Asset Management file upload
    cvelistv5