CVE-2011-1395

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the imicon.jsp page of IBM Maximo Asset Management and Asset Management Essentials. The controlid parameter is not properly sanitized before being reflected in the server response, allowing injection of arbitrary web script or HTML. Affected versions include Maximo Asset Management and Asset Management Essentials V6.2, V7.1, and V7.5 [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL containing a controlid parameter with embedded script code. The victim must be tricked into clicking the link (e.g., via email or another web page). No authentication is required, and the attacker does not need any special network position beyond the ability to deliver the link to the victim [1].

Impact

Successful exploitation leads to arbitrary JavaScript execution in the victim's browser within the security context of the affected Maximo application. This can result in session theft, application defacement, or redirection to malicious sites. The CVSS base score for CVE-2011-1395 is 4.3 (Medium) [1].

Mitigation

IBM addressed this vulnerability in a security bulletin released in 2012. Administrators should upgrade to the appropriate fix levels as specified in the IBM advisory for Maximo Asset Management V6.2, V7.1, and V7.5 [1]. No workarounds are documented in the available references.