Cognos Controller Vulnerable to SQL Injection
CVE-2023-38724

9.8CRITICAL

Key Information:

Vendor

IBM
Status
Cognos Controller
Vendor
CVE Published:
3 May 2024

What is CVE-2023-38724?

The vulnerability affecting IBM Cognos Controller versions 10.4.1, 10.4.2, and 11.0.0 is identified as an SQL injection flaw. This security issue enables a remote attacker to exploit the system by sending specially crafted SQL queries. As a result, an attacker could gain unauthorized access to the back-end database, posing a risk of viewing, adding, modifying, or even deleting sensitive data. Addressing this vulnerability is imperative to maintain the integrity and security of database operations.

References

https://www.ibm.com/support/pages/node/7149876
https://exchange.xforce.ibmcloud.com/vulnerabilities/262183

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.