Lucene search

[email protected]CVE-2014-4810

HistoryNov 05, 2014 - 11:55 a.m.

CVE-2014-4810

2014-11-0511:55:06

CWE-264

[email protected]

web.nvd.nist.gov

ibm

cognos mobile

vulnerability

session preservation

remote attack

authentication data

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.9 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.2%

JSON

IBM Cognos Mobile 10.1.1 before FP3 IF1, 10.2.0 before FP2 IF1, and 10.2.1 before FP4 IF1 preserves a session between the Cognos Mobile server and the Cognos Business Intelligence server after a logoff action on a mobile device, which makes it easier for remote attackers to bypass intended Business Intelligence restrictions by leveraging access to authentication data that was captured before this logoff.

Affected configurations

NVD

Node

ibmcognos_mobileMatch10.1.1

ibmcognos_mobileMatch10.2.0

ibmcognos_mobileMatch10.2.1

CPENameOperatorVersion
ibm:cognos_mobileibm cognos mobileeq10.1.1
ibm:cognos_mobileibm cognos mobileeq10.2.0
ibm:cognos_mobileibm cognos mobileeq10.2.1

CPE	Name	Operator	Version
ibm:cognos_mobile	ibm cognos mobile	eq	10.1.1
ibm:cognos_mobile	ibm cognos mobile	eq	10.2.0
ibm:cognos_mobile	ibm cognos mobile	eq	10.2.1

References

www-01.ibm.com/support/docview.wss?uid=swg21684608

exchange.xforce.ibmcloud.com/vulnerabilities/95386

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.9 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.2%

JSON

Related for CVE-2014-4810

cvelist1 prion1 nvd1