Overview :
Multiple security vulnerabilities have been updated in IBM products
Affected Product(s) :
  • IBM Maximo Asset Management 7.6
  • IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5

 

Vulnerability Details :
CVE ID :CVE-2019-4486
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164070.
CVE ID :CVE-2019-4459
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163656.
CVE ID :CVE-2019-4398
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 could allow a local user to obtain sensitive information from SessionManagement cookies. IBM X-Force ID: 162259.
CVE ID :CVE-2019-4397
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 162239

Solution :

For Maximo Asset Management 7.6:

VRMFix Pack, Feature Pack, or Interim FixDownload
7.6.1.1Maximo Asset Management 7.6.1.1 iFix:
7.6.1.1-TIV-MBS-IFIX001 or latest Interim Fix available
FixCentral
7.6.0.10Maximo Asset Management 7.6.0.10 iFix:
7.6.0.10-TIV-MBS-IFIX008 or latest Interim Fix available
FixCentral

The recommended solution is to apply the fixes as soon as practical.

Principal Product and Version(s)VRMFRemediation/First Fix
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise2.5, 2.5.0.1, 2.5.0.2, 2.5.0.3, 2.5.0.4, 2.5.0.5, 2.5.0.6, 2.5.0.7, 2.5.0.8, 2.5.0.9For 2.5 versions, IBM recommends upgrading to Fix Pack 10 (2.5.0.10) of IBM Cloud Orchestrator:

https://www.ibm.com/support/pages/ibm-cloud-orchestrator-fix-pack-10-25010-25

IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise2.4, 2.4.0.1, 2.4.0.2, 2.4.0.3, 2.4.0.4, 2.4.0.5
Contact IBM Cloud Orchestrator support.