IBM Cognos Analytics Mobile (iOS) authentication bypass (IBM Cognos Analytics Mobile)
En bref
- Source
- NVD
- EPSS
- EPSS 0.21 % · centile 11 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- ibm
- Statut NVD
- Analyzed
Description
IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 is vulnerable to authentication bypass by using the Local Authentication Framework library which is not needed as biometric authentication is not used in the application.
Faiblesses (CWE)
- CWE-299 — Vérification incorrecte de la révocation d'un certificat
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.2 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N | ibm |
| CVSS 3.1 | MEDIUM 5.2 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N | NVD · psirt@us.ibm.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.6 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2025-22134
- GCVE · GCVE-0-2025-36057
Configurations affectées (CPE NVD)
cpe:2.3:a:ibm:cognos_analytics_mobile:*:*:*:*:*:iphone_os:*:*≥ 1.1.0 < 1.1.23
Produits affectés
| Produit | Versions |
|---|---|
| IBM · Cognos Analytics Mobile | affected 1.1.0 ≤ 1.1.22 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |