Lucene search

IbmCVE-2023-23474

HistoryMay 03, 2024 - 6:15 p.m.

CVE-2023-23474

2024-05-0318:15:08

CWE-209

ibm

web.nvd.nist.gov

ibm

cognos controller

stack trace

sensitive information

exposure

remote attacker

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.9

Confidence

Low

EPSS

Percentile

9.0%

JSON

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 245403.

Affected configurations

Vulners

Vulnrichment

Node

ibmcognos_controllerMatch10.4.1

ibmcognos_controllerMatch10.4.2

ibmcognos_controllerMatch11.0.0

VendorProductVersionCPE
ibmcognos_controller10.4.1cpe:2.3:a:ibm:cognos_controller:10.4.1:*:*:*:*:*:*:*
ibmcognos_controller10.4.2cpe:2.3:a:ibm:cognos_controller:10.4.2:*:*:*:*:*:*:*
ibmcognos_controller11.0.0cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	cognos_controller	10.4.1	cpe:2.3:a:ibm:cognos_controller:10.4.1:::::::*
ibm	cognos_controller	10.4.2	cpe:2.3:a:ibm:cognos_controller:10.4.2:::::::*
ibm	cognos_controller	11.0.0	cpe:2.3:a:ibm:cognos_controller:11.0.0:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Cognos Controller",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "10.4.1, 10.4.2, 11.0.0"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/245403

www.ibm.com/support/pages/node/7149876

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.9

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2023-23474