CVE-2014-3025: Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x a...

Security readout for executives and security teams

This vulnerability lets a logged-in remote user place malicious script or HTML into IBM Maximo-related web pages. If triggered in another user's browser, it could support session theft, unauthorized actions, or misleading page content. The public bundle does not provide a CVSS score or confirmed exploitation. Exposure is most likely in organizations still running legacy IBM Maximo Asset Management or the listed Maximo-based SmartCloud Control Desk and Tivoli Asset Management for IT versions. The issue requires authenticated remote access, so risk depends heavily on account controls and whether Maximo is reachable beyond trusted networks. Treat this as a legacy application hygiene issue with moderate urgency. It is not cited as actively exploited in the provided sources, but affected Maximo systems often support operational workflows, so unpatched authenticated XSS can still create business risk. Mitigation focus: Identify any IBM Maximo deployments matching the listed affected version ranges.; Review the IBM support documents and APAR for vendor-stated fixes or upgrade paths.; Move affected systems to an IBM-supported fixed level where vendor guidance identifies one..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.