Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-1558: IBM Maximo Asset Management can redirect users to fake sites

CVE-2017-1558 · published 8 years ago

Summary

Versions 7.5 and 7.6 of IBM Maximo Asset Management may let a remote attacker send a user to a malicious web page that looks like a trusted one. This open‑redirect flaw can be used for phishing to steal sensitive information. Install any available security updates from IBM and educate users to verify URLs before clicking links.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	maximo_asset_management	7.5 7.6 `cpe:2.3:a:ibm:maximo_asset_management:7.5:::::::*`
ibm	maximo_asset_management_essentials	7.5 `cpe:2.3:a:ibm:maximo_asset_management_essentials:7.5:::::::*`

Original advisory text

IBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 131548.

References

http://www.ibm.com/support/docview.wss?uid=swg22010595 Issue Tracking Vendor Advisory
http://www.securityfocus.com/bid/102211 Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/131548 Issue Tracking VDB Entry Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-601Open Redirect

Timeline

Published13 Dec 2017

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-1558 · NVD

Track software like this

Free during beta