CVE:CVE-2012-0195
CNNVD:CNNVD-201203-237
IBM Maximo Asset Management软件为所有资产类型提供综合性资产生命周期和维护管理。
IBM Maximo Asset Management和Asset Management Essentials 6.2版本、7.1版本和7.5版本，基于IT 6.2、7.1和7.2版本的IBM Tivoli Asset Managemen，IBM Tivoli Service Request Manager 7.1 和7.2版本，IBM Maximo Service Desk 6.2版本，IBM Tivoli Change和Configuration Management Database (CCMDB) 6.2版本，7.1和7.2版本中的Start Center Layout和 Configuration组件中存在跨站脚本漏洞（XSS）。远程攻击者可利用漏洞借助显示名，注入任意web脚本或HTML。
solution:Upgrade ibm maximo_asset_management to a higher version than 6.2,7.1,7.5,and avoid the version 6.2,7.1,7.5; Upgrade ibm maximo_asset_management_essentials to a higher version than 6.2,7.1,7.5,and avoid the version 6.2,7.1,7.5; Upgrade ibm tivoli_asset_management_for_it to a higher version than 6.2,7.1,7.2,and avoid the version 6.2,7.1,7.2; Upgrade ibm trivoli_service_request_manager to a higher version than 7.1,7.2,and avoid the version 7.1,7.2; Upgrade ibm maximo_service_desk to a higher version than 6.2,and avoid the version 6.2; Upgrade ibm tivoli_change_and_configuration_management_database to a higher version than 6.2,7.1,7.2,and avoid the version 6.2,7.1,7.2