CVE-2020-4463

high · 8.2

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181484.

8.2

CVSS

31.6%

EPSS (exploit prob.)

98th

EPSS percentile

2020-07-29

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Weaknesses

CWE-611

Affected products

Vendor	Product	Affected versions
ibm	maximo_asset_management	7.6.0.1
ibm	maximo_asset_management	7.6.0.2

Check a specific version with /api/v1/cve/match.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/181484
https://www.ibm.com/support/pages/node/6253953
https://exchange.xforce.ibmcloud.com/vulnerabilities/181484
https://www.ibm.com/support/pages/node/6253953

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-4463