CVE-2023-32335
Ibm Maximo Application Suite 8.10 … 8.11
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2023-32335 is a low-severity Use of HTTP Request With Sensitive Query String (CWE-598) vulnerability in Ibm Maximo Application Suite. Its CVSS base score is 3.7 (Low).
Operationally, ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-36579
Vulnerability Data
IBM Maximo Application Suite 8.10, 8.11 and IBM Maximo Asset Management 7.6.1.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.…
more
IBM X-Force ID: 255075.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.4.5V14.2.1
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Protects sensitive data placed in query strings from interception in transit when confidentiality controls like HTTPS are enforced.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent embedding sensitive data in query strings as part of input-handling and data-flow design.
HTTPS encryption protects query strings in transit but does not address the root design flaw of placing sensitive data in URLs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect sensitive data leakage via query strings.
DLP solutions can detect and block sensitive data in URLs.
Network security controls can enforce HTTPS and block sensitive data in URLs.
Application security requirements should mandate avoiding sensitive data in query strings.
Secure architecture principles discourage exposing sensitive data in URLs.
Secure coding standards directly prohibit placing secrets in query parameters.