CVE-2015-4965: IBM Change And Configuration Management Database

Medium severity, CVSS 4.0. EPSS: 1% chance of exploitation in the next 30 days.

maximouiweb/webmodule/webclient/utility/merlin.jsp in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX004, and 7.6.0 before 7.6.0.1 IFIX002; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX004 and 7.6.0 before 7.6.0.1 IFIX002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to obtain sensitive information by reading a (1) backup or (2) debug application file.

Affected products

IBM Change And Configuration Management Database: version 7.1 only; version 7.2 only
IBM Maximo Asset Management: version 7.1 only; version 7.1.1 only; version 7.1.1.1 only; version 7.1.1.2 only; version 7.1.1.5 only; version 7.1.1.6 only; …
IBM Maximo Asset Management Essentials: version 7.1 only; version 7.5 only
IBM Maximo For Energy Optimization: version 7.1 only
IBM Maximo For Government: version 7.1 only; version 7.5.0.0 only; version 7.5.0.1 only; version 7.5.0.2 only; version 7.5.0.3 only; version 7.5.0.4 only; …
IBM Maximo For Life Sciences: version 7.1 only; version 7.5.0.0 only; version 7.5.0.1 only; version 7.5.0.2 only; version 7.5.0.3 only; version 7.5.0.4 only; …
IBM Maximo For Nuclear Power: version 7.1 only; version 7.5.0.0 only; version 7.5.0.1 only; version 7.5.0.2 only; version 7.5.0.3 only; version 7.5.0.4 only; …
IBM Maximo For Oil And Gas: version 7.1 only; version 7.5.0.0 only; version 7.5.0.1 only; version 7.5.0.2 only; version 7.5.0.3 only; version 7.5.0.4 only; …
IBM Maximo For Transportation: version 7.1 only; version 7.5.0.0 only; version 7.5.0.1 only; version 7.5.0.2 only; version 7.5.0.3 only; version 7.5.0.4 only; …
IBM Maximo For Utilities: version 7.1 only; version 7.5.0.0 only; version 7.5.0.1 only; version 7.5.0.2 only; version 7.5.0.3 only; version 7.5.0.4 only; …
IBM Smartcloud Control Desk: version 7.5 only
IBM Tivoli Asset Management For It: version 7.1 only; version 7.2 only
IBM Tivoli Service Request Manager: version 7.1.0 only; version 7.2.0.0 only

Published 2015-10-06. Last modified 2026-06-17.