Cross-site request forgery (CSRF) vulnerability in IBM Maximo Asset Management 6.2 through 7.5, as used in SmartCloud Control Desk, Tivoli A

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• ibm change and configuration management database6.0
• ibm change and configuration management database7.0
• ibm maximo asset management6.2.0.0
• ibm maximo asset management7.1.0.0
• ibm maximo asset management7.5.0.0
• ibm maximo service desk6.2
• ibm smartcloud control desk7.0
• ibm tivoli asset management for it6.0
• ibm tivoli asset management for it6.2
• ibm tivoli asset management for it7.0
• ibm tivoli asset management for it7.1
• ibm tivoli asset management for it7.2
• ibm tivoli service request manager7.0

Other highest-scoring records for the same primary product.

• CVE-2013-3323A Privilege Escalation Vulnerability exists in IBM Maximo Asset Management 7.5, 7.1, and 6.2, when WebSeal with Basic Authentication is used
  40Plan
• CVE-2015-0104IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8
  37Monitor
• CVE-2015-0107IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8
  28Monitor
• CVE-2012-2183Session fixation vulnerability in IBM Maximo Asset Management 6.2 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management f
  28Monitor
• CVE-2012-2184Session fixation vulnerability in IBM Maximo Asset Management 7.1 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management f
  27Monitor
• CVE-2015-4966IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 FP009, and 7.6.0 before 7.6.0.2 IFIX001; Maximo Asset Management 7.5.
  26Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

State-changing requests rely on the session cookie the browser sends automatically; nothing verifies that the request came from the user’s own page.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1app.use(session({ cookie: { httpOnly: true } }));2app.post("/account/address", updateAddress);

1app.use(session({ cookie: { httpOnly: true, sameSite: "lax" } }));2app.post("/account/address", csrfProtection, updateAddress);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.