CVE-2025-14684

IBM Maximo Application Suite - Monitor Component 9.1, 9.0, 8.11, and 8.10 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

CVSS v3 4.0 MEDIUM

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7267481	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:maximo_application_suite::::::::
	cpe:2.3:a:ibm:maximo_application_suite::::::::
	cpe:2.3:a:ibm:maximo_application_suite::::::::
	cpe:2.3:a:ibm:maximo_application_suite::::::::

History

No history.

Information

Published : 2026-03-25 22:16

Updated : 2026-06-17 08:36

NVD link : CVE-2025-14684

Mitre link : CVE-2025-14684

CVE.ORG link : CVE-2025-14684

JSON object : View

Products Affected

ibm

maximo_application_suite

CWE

CWE-117

Improper Output Neutralization for Logs

{"id": "CVE-2025-14684", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14684", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-28T01:49:07.548739Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:maximo_application_suite___monitor_component:9.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite___monitor_component:9.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite___monitor_component:9.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite___monitor_component:9.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite___monitor_component:8.11:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite___monitor_component:8.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite___monitor_component:8.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite___monitor_component:8.10.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Maximo Application Suite - Monitor Component", "versions": [{"status": "affected", "version": "9.1"}, {"status": "affected", "version": "9.0"}, {"status": "affected", "version": "8.11"}, {"status": "affected", "version": "8.10"}]}]}], "published": "2026-03-25T22:16:18.660", "references": [{"url": "https://www.ibm.com/support/pages/node/7267481", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-117"}]}], "descriptions": [{"lang": "en", "value": "IBM Maximo Application Suite - Monitor Component 9.1, 9.0, 8.11, and 8.10 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files."}, {"lang": "es", "value": "IBM Maximo Application Suite - Monitor Component 9.1, 9.0, 8.11 y 8.10 podr\u00eda permitir a un usuario no autorizado inyectar datos en los mensajes de registro debido a una neutralizaci\u00f3n inadecuada de elementos especiales al escribirse en los archivos de registro."}], "lastModified": "2026-06-17T08:36:23.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "202DA614-9FA9-49BB-A847-97ACE508822E", "versionEndExcluding": "8.10.26", "versionStartIncluding": "8.10"}, {"criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2118EDE1-491F-4697-BD79-4261F62FE712", "versionEndExcluding": "8.11.24", "versionStartIncluding": "8.11"}, {"criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96448D2A-6208-4B95-B43C-08DF6746FC3F", "versionEndExcluding": "9.0.16", "versionStartIncluding": "9.0"}, {"criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BCEFF22-070F-47FA-9C14-CCDA3B6AE38A", "versionEndExcluding": "9.1.6", "versionStartIncluding": "9.1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}