#VU67577 Improper Authentication in IBM Maximo Asset Management - CVE-2022-40616

Vulnerability identifier: #VU67577

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-40616

CWE-ID: CWE-287

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
IBM Maximo Asset Management
Server applications / Other server solutions

Vendor: IBM Corporation

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an unspecified error, related to disabled mxe.int.enableosauth property. A remote attacker can bypass authentication process and gain unauthorized access to the application.

Mitigation

The vendor recommends the following workaround:

Before proceeding, ensure that security is configured for all object structures. After the following change is implemented, no access is permitted except through explicitly defined security.
1. Go to the System Properties application and locate the property mxe.int.enableosauth.
2. Set the value for that property to 1 and save.
3. Live refresh the property value.

Vulnerable software versions

IBM Maximo Asset Management: 7.6.1.1 - 7.6.1.3

---

External links
https://www.ibm.com/support/pages/node/6621599
https://exchange.xforce.ibmcloud.com/vulnerabilities/236311

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.