LiveActive security incident?Get immediate response
CVE Record

CVE-2019-4650: IBM Maximo Asset Management 7.6.1.1 is vulnerable to SQL injection.

IBM Maximo Asset Management 7.6.1.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 170961.

MediumCVSS 6.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

IBM Maximo Asset Management 7.6.1.1 has a SQL injection flaw that could let an authenticated remote attacker access or change back-end database records. The business risk is data confidentiality, integrity, and availability impact in an asset-management system.

Executive priority

Prioritize as a planned remediation item unless the affected Maximo instance is externally exposed, highly privileged, or supports critical operations. Escalate if validation finds suspicious activity or broad user access.

Technical view

CVE-2019-4650 is a network-reachable SQL injection in IBM Maximo Asset Management 7.6.1.1. The CVSS 3.0 score is 6.3 with low attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality, integrity, and availability impact.

Likely exposure

Exposure is most likely where IBM Maximo Asset Management 7.6.1.1 is deployed and reachable by authenticated users over the network. The source bundle does not identify affected configurations beyond version 7.6.1.1.

Exploitation context

The CVE source marks exploit maturity as unproven, and it is not listed in KEV. The supplied sources do not show active exploitation or public exploit use, so treat exploitation status as unconfirmed.

Researcher notes

Evidence is limited to the CVE description, CVSS vector, IBM advisory reference, and IBM X-Force entry. The supplied bundle does not include vulnerable parameter details, exploit procedures, or exact fixed versions.

Mitigation direction

  • Inventory IBM Maximo Asset Management instances and confirm whether version 7.6.1.1 is present.
  • Review IBM advisory 6223922 for the official remediation path before making changes.
  • Apply IBM-provided fixes or upgrades according to vendor guidance and change-control requirements.
  • Restrict Maximo access to trusted networks while remediation is being planned.
  • Increase monitoring for unusual database changes tied to Maximo application accounts.

Validation and detection

  • Confirm installed Maximo version through approved asset or application inventory records.
  • Check whether IBM advisory 6223922 remediation has been applied.
  • Review application logs for unexpected SQL errors or anomalous authenticated activity.
  • Verify Maximo database audit logs for unauthorized reads, changes, additions, or deletions.
  • Document any internet-facing or broad internal access paths to affected instances.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-4650 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.3 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/A:L/AV:N/AC:L/I:L/UI:N/S:U/C:L/PR:L/RL:O/RC:C/E:U

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.3CVSS 3.0MediumCVSS:3.0/A:L/AV:N/AC:L/I:L/UI:N/S:U/C:L/PR:L/RL:O/RC:C/E:U2.83.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

6.3Medium
CVSS 3.0 vector shape for CVE-2019-4650Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/A:L/AV:N/AC:L/I:L/UI:N/S:U/C:L/PR:L/RL:O/RC:C/E:U

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
IBMMaximo Asset Management7.6.1.1Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.