description: IBM Maximo Asset Management 7.6 through 7.6.3 installs with a default administrator account that a remote intruder could use to gain administrator access to the system. This vulnerability is due to an incomplete fix for CVE-2015-4966. IBM X-Force ID: 142116.
problem types: Gain Access
affected:
{
product: Maximo Asset Management
vendor: IBM
versions:
status: affected, version: 7.6
status: affected, version: 7.6.0
status: affected, version: 7.6.0.1
status: affected, version: 7.6.1
status: affected, version: 7.6.2
status: affected, version: 7.6.2.1
status: affected, version: 7.6.2.2
status: affected, version: 7.6.2.3
status: affected, version: 7.6.2.4
status: affected, version: 7.6.3
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: UNPROVEN
integrityImpact: HIGH
privilegesRequired: LOW
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.7
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.0/A:H/AC:L/AV:N/C:H/I:H/PR:L/S:U/UI:N/E:U/RC:C/RL:O
version: 3.0
]