Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities

2020-10-0920:01:39

www.ibm.com

ibm cognos analytics

vulnerabilities

arbitrary code execution

denial of service

cve-2020-1747

cve-2020-4302

cve-2020-4388

pyyaml

csv injection

EPSS

0.006

Percentile

77.9%

JSON

Summary

Security vulnerabilities have been addressed in IBM Cognos Analytics.

Vulnerability Details

CVEID:CVE-2020-1747
**DESCRIPTION:**PyYAML could allow a remote attacker to execute arbitrary code on the system, caused by an error when processing untrusted YAML files through the full_load method or with the FullLoader loader. By abusing the python/object/new constructor, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/178416 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2020-4302
**DESCRIPTION:**IBM Cognos Analytics could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. By persuading a victim to open a specially-crafted excel file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/176610 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)

CVEID:CVE-2020-4388
**DESCRIPTION:**IBM Cognos Analytics could be vulnerable to a denial of service attack by failing to catch exceptions in a servlet also exposing debug information could also be used in future attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/179270 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)