IBM Cognos Controller information disclosure (IBM Cognos Controller)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.37 % · percentile 30 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- ibm
- NVD status
- Analyzed
Description
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 196640.
Weaknesses (CWE)
- CWE-565 — Reliance on Cookies without Validation and Integrity Checking
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N | ibm |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N | NVD · psirt@us.ibm.com (Secondary) |
European references
- ENISA EUVD · EUVD-2021-7868
- GCVE · GCVE-0-2021-20450
Affected configurations (NVD CPE)
cpe:2.3:a:ibm:cognos_controller:10.4.1:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_controller:10.4.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| IBM · Cognos Controller | affected 10.4.1, 10.4.2, 11.0.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |