{"id":"CVE-2020-4463","published":"2020-07-29T14:05:29Z","modified":"2024-09-16T21:02:19Z","title":"IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when…","vendor":"IBM","product":"Maximo Asset Management","tier":"core","eol":null,"affectedVersions":[{"vendor":"IBM","product":"Maximo Asset Management","versions":["7.6.0.1","7.6.0.2"]}],"description":{"text":"IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181484.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8.2,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/S:U/PR:N/UI:N/AV:N/I:N/C:H/AC:L/A:L/RL:O/RC:C/E:U","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.3159,"percentile":0.98285,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-01-22","exploitedFirstSeen":"2024-01-22","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2020-4463","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2020-4463","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2020-4463","date":"2024-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-27&host_type=src&vulnerability=cve-2020-4463","date":"2024-01-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-28&host_type=src&vulnerability=cve-2020-4463","date":"2024-01-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-29&host_type=src&vulnerability=cve-2020-4463","date":"2024-01-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-30&host_type=src&vulnerability=cve-2020-4463","date":"2024-01-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-31&host_type=src&vulnerability=cve-2020-4463","date":"2024-01-31"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-01&host_type=src&vulnerability=cve-2020-4463","date":"2024-02-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-07&host_type=src&vulnerability=cve-2020-4463","date":"2024-02-07"}],"evidenceTotal":505,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.ibm.com/support/pages/node/6253953","tags":["x_refsource_CONFIRM"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/181484","tags":["vdb-entry","x_refsource_XF"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-25710","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25710","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2020-08-13","earliestUrl":"https://github.com/Ibonok/CVE-2020-4463","repos":[{"name":"Ibonok/CVE-2020-4463","url":"https://github.com/Ibonok/CVE-2020-4463","stars":51,"created":"2020-08-13"}]},"nuclei":[{"id":"CVE-2020-4463","name":"IBM Maximo Asset Management Information Disclosure - XML External Entity Injection","severity":"high","path":"http/cves/2020/CVE-2020-4463.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-4463.yaml"}],"first":{"date":"2020-08-13","source":"PoC-in-GitHub","url":"https://github.com/Ibonok/CVE-2020-4463"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-07-29","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-4463","provenance":"source"},{"date":"2020-08-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Ibonok/CVE-2020-4463","provenance":"source"},{"date":"2024-01-22","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2020-4463","provenance":"source"}],"speed":{"daysToPublicExploit":15,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":65.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1011 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.66,"detail":"percentile 0.9829"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.74,"detail":"base score 8.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}