Lucene search

IbmVULNRICHMENT:CVE-2023-28952

HistoryMay 03, 2024 - 5:39 p.m.

CVE-2023-28952 IBM Cognos Controller log injection

2024-05-0317:39:23

CWE-117

ibm

github.com

ibm

cognos

controller

injection

vulnerability

logging

x-force

10.4.1

10.4.2

11.0.0

sanitizing

user data

ibm x-force id 251463

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

6.7

Confidence

Low

EPSS

Percentile

9.0%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to injection attacks in application logging by not sanitizing user provided data. IBM X-Force ID: 251463.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:ibm:cognos_controller:10.4.1:*:*:*:*:*:*:*"
    ],
    "vendor": "ibm",
    "product": "cognos_controller",
    "versions": [
      {
        "status": "affected",
        "version": "10.4.1"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:ibm:cognos_controller:10.4.2:*:*:*:*:*:*:*"
    ],
    "vendor": "ibm",
    "product": "cognos_controller",
    "versions": [
      {
        "status": "affected",
        "version": "10.4.2"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*"
    ],
    "vendor": "ibm",
    "product": "cognos_controller",
    "versions": [
      {
        "status": "affected",
        "version": "11.0.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/251463

www.ibm.com/support/pages/node/7149876

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

6.7

Confidence

Low

EPSS

Percentile

9.0%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2023-28952