Security readout for executives and security teams
Plain-English summary
An authenticated IBM Maximo Asset Management 7.6 user could probe the application to discover valid usernames. This does not grant direct access or alter data, but it can reduce the effort needed for password guessing, phishing, or privilege-targeting campaigns against operational asset-management environments.
Executive priority
Treat as a moderate-priority hardening and patch-management issue, especially for critical operations environments. It is not described as direct system compromise, but username disclosure can make later credential attacks more efficient.
Technical view
CVE-2018-1697 is a network-reachable username enumeration issue in IBM Maximo Asset Management 7.6. The CVSS 3.0 vector indicates low attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality impact. Integrity and availability are not directly impacted in the provided record.
Likely exposure
Exposure is limited to organizations running IBM Maximo Asset Management 7.6 where authenticated users can reach the affected application. Public internet exposure is not required, but broad internal access or weak account controls increase practical risk.
Exploitation context
The provided bundle does not show CISA KEV listing or active exploitation evidence. Exploitation requires an authenticated user and is described only as username enumeration through a specially crafted HTTP request, so business concern is follow-on credential or social engineering risk.
Researcher notes
The source bundle identifies IBM X-Force ID 145966 and CVSS 3.0 score 4.3. No CWE, exploit details, or specific fixed version text is included here. Avoid assuming impact beyond authenticated username enumeration for IBM Maximo Asset Management 7.6.
Mitigation direction
- Check IBM advisory guidance for the official Maximo 7.6 remediation or update path.
- Restrict Maximo access to authorized networks and users only.
- Review account lockout, MFA, and password policy coverage for Maximo users.
- Monitor authentication and application logs for unusual username discovery patterns.
Validation and detection
- Confirm whether IBM Maximo Asset Management 7.6 exists in the environment.
- Verify installed Maximo maintenance level against IBM advisory guidance.
- Review whether low-privilege accounts can access the affected application paths.
- Check logs for repeated failed or unusual account lookup behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-1697 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/A:N/AC:L/AV:N/C:L/I:N/PR:L/S:U/UI:N/E:U/RC:C/RL:O
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/A:N/AC:L/AV:N/C:L/I:N/PR:L/S:U/UI:N/E:U/RC:C/RL:O2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
4.3MediumVector: CVSS:3.0/A:N/AC:L/AV:N/C:L/I:N/PR:L/S:U/UI:N/E:U/RC:C/RL:O
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/docview.wss?uid=ibm10737457CVE reference · x_refsource_CONFIRM
- ibm-maximo-cve20181697-info-disc(145966)CVE reference · vdb-entry, x_refsource_XF
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.