CVE-2014-0915: IBM Maximo Asset Management

Low severity, CVSS 3.5. EPSS: 1% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.2, and 7.2 for Tivoli Asset Management for IT and certain other products allow remote authenticated users to inject arbitrary web script or HTML via (1) the KPI display name field or (2) a portlet field.

Affected products

  • IBM Maximo Asset Management: version 6.2 only; version 6.2.1 only; version 6.2.2 only; version 6.2.3 only; version 6.2.4 only; version 6.2.5 only; …
  • IBM Maximo Asset Management Essentials: up to and including 7.5.0.6; version 6.2.0.0 only; version 7.1 only; version 7.5.0.0 only; version 7.5.0.1 only; version 7.5.0.2 only; …
  • IBM Maximo For Government: up to and including 7.5.0.6; version 7.1 only; version 7.5.0.0 only; version 7.5.0.1 only; version 7.5.0.2 only; version 7.5.0.3 only; …
  • IBM Maximo For Life Sciences: up to and including 7.5.0.6; version 7.1 only; version 7.5.0.0 only; version 7.5.0.1 only; version 7.5.0.2 only; version 7.5.0.3 only; …
  • IBM Maximo For Nuclear Power: up to and including 7.5.0.6; version 7.1 only; version 7.5.0.0 only; version 7.5.0.1 only; version 7.5.0.2 only; version 7.5.0.3 only; …
  • IBM Maximo For Oil And Gas: up to and including 7.5.0.6; version 7.1 only; version 7.5.0.0 only; version 7.5.0.1 only; version 7.5.0.2 only; version 7.5.0.3 only; …
  • IBM Maximo For Transportation: up to and including 7.5.0.6; version 7.1 only; version 7.5.0.0 only; version 7.5.0.1 only; version 7.5.0.2 only; version 7.5.0.3 only; …
  • IBM Maximo For Utilities: up to and including 7.5.0.6; version 7.1 only; version 7.5.0.0 only; version 7.5.0.1 only; version 7.5.0.2 only; version 7.5.0.3 only; …
  • IBM Maximo Service Desk: up to and including 6.2.8
  • IBM Smartcloud Control Desk: up to and including 7.5.0.6; version 7.5 only; version 7.5.0.0 only; version 7.5.0.1 only; version 7.5.0.2 only; version 7.5.0.3 only; …
  • IBM Tivoli It Asset Management For It: up to and including 6.2.8

Published 2014-07-30. Last modified 2026-06-17.