CVE-2023-32344
IBM Cognos Analytics cross-site request forgery
At a glance Severity MEDIUM 4.3 EPSS EPSS 0.38 % · percentile 32 (2026-10-27) State PUBLISHED Published 2024-02-24 Updated 2025-02-13 Assigner ibm NVD status Analyzed Description IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path. IBM X-Force ID: 255898.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N ibm CVSS 3.1 MEDIUM 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N NVD · psirt@us.ibm.com (Secondary) CVSS 3.1 MEDIUM 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:* ≥ 11.1.1 < 11.1.7cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:* ≥ 11.2.0 < 11.2.4cpe:2.3:a:ibm:cognos_analytics:11.1.7:-:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack1:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack2:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack3:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack4:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack5:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack6:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack7:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack1:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack2:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.1:*:*:*:*:*:*:*Affected products
References
Sources
