CVE-2023-47718 is a cross-site request forgery flaw in IBM Maximo Asset Management 7.6.1.3 and the Manage component 8.10 through 8.11. NVD scores it 4.3, Medium. An attacker could trigger unauthorized actions as a signed-in user. For 7.6.1.3, IBM lists interim fix 7.6.1.3-TIV-MBS-IF013 or the latest interim fix.
What's affected
The NVD record lists Maximo Asset Management 7.6.1.3 and the Manage component 8.10 through 8.11, which is part of Maximo Application Suite. IBM published two bulletin pages for this CVE. I read one of them, and it covers Maximo Asset Management 7.6.1.3 with the fix 7.6.1.3-TIV-MBS-IF013, or the latest interim fix available on Fix Central. The second page, node 7107740, is cited in the record, and I did not read it. Use it to find the fix for the Manage component of Maximo Application Suite.
IBM says the problem is in the CSRF token used by the Maximo Asset Management application. The weakness is CWE-352. IBM lists no workarounds.
The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, and IBM's bulletin gives the same 4.3 in CVSS 3.0 form. No conflict on severity. Source note on versions: the page I read lists only 7.6.1.3, while the record also lists Manage 8.10 through 8.11, because the second bulletin covers those.
How to check if you're exposed
For Maximo Asset Management, log in and open System Information. The core product version is the Tivoli process automation engine version, as IBM notes. Compare it with 7.6.1.3, and check whether the interim fix is installed.
For the Manage component, check the application suite release and component version in the suite administration, and then follow IBM's second bulletin for the matching fix.
What to do now
- For 7.6.1.3, install interim fix 7.6.1.3-TIV-MBS-IF013, or the latest interim fix, from Fix Central, following the readme.
- For Manage 8.10 and 8.11, open IBM's second bulletin and apply the fix it lists.
- Sign users out of Maximo when they finish work, and avoid browsing untrusted sites in the same browser session.
- Review any integrations that call Maximo through a browser session, and make sure they use their own credentials.
- Keep a record of the fix level for each environment, including test.
Why it matters
Cross-site request forgery, CWE-352, exploits the way browsers attach login cookies to every request for a site. If the application accepts a state-changing request without a token that proves the request came from its own pages, another page can make the browser send it.
IBM describes the fault as being in the CSRF token the application uses. That points at a defence that exists but does not do its full job. The effect, per the vector, is a Low integrity change with no confidentiality or availability impact, and it requires the victim to click or load something.
That is why the score is 4.3. For an asset management system the actions a signed-in user can take, such as editing work orders or asset records, are what an attacker would aim at. A low score is not a reason to skip the interim fix, since the update is routine.
Quick check
Does this need user interaction?
Yes. NVD's vector marks user interaction as required.
Where do I find the Manage fix?
IBM's second bulletin for this CVE, node 7107740, which the record cites.
Sources
- IBM security bulletin for Maximo Asset Management
- IBM second bulletin cited in the record (not read)
- IBM X-Force entry 271843
- Safeguard Gold page for CVE-2023-47718
Last reviewed: 19 October 2026.
