CVE-2017-1176

Vulnerability

IBM Maximo Asset Management versions 7.1, 7.5, and 7.6, as well as affected industry solution and control desk products using these core versions [1], retain attachment data inappropriately after deletion. This information disclosure vulnerability (CVE-2017-1176) resides in the attachment handling mechanism and does not require any special configuration to be reachable. The core product version, based on the Tivoli process automation engine, must be an affected version [1].

Exploitation

To exploit this vulnerability, an attacker must have local access to the system [1]. No authentication or user interaction is required beyond being able to access the local file system or database where deleted attachments are retained. The attacker can then retrieve the sensitive data from the residual attachment storage [1].

Impact

Successful exploitation allows a local user to obtain sensitive information that was intended to be removed [1]. The impact is limited to information disclosure (confidentiality) with a CVSS v3 base score of 3.3 (Low). The integrity and availability of the system are not affected [1].

Mitigation

IBM released a fix as part of the Maximo Asset Management 7.6.0.4 Interim Fix 1 (and equivalent fixes for 7.5 and 7.1) [1]. Users should apply the fix from IBM Fix Central. No workaround is documented in the available references. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of publication date.