PT-2014-7065 · Ibm · Ibm Cognos Business Intelligence

Publicado 2014-12-12 · Atualizado 2017-09-08 · CVE-2014-6145

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Cognos Business Intelligence versions 10.1 before IF10 IBM Cognos Business Intelligence versions 10.1.1 before IF9 IBM Cognos Business Intelligence versions 10.2 before IF11 IBM Cognos Business Intelligence versions 10.2.1 before IF8 IBM Cognos Business Intelligence versions 10.2.1.1 before IF7

Description A cross-site scripting (XSS) issue exists in the server, allowing remote authenticated users to inject arbitrary web script or HTML via a crafted URL. This can be achieved by manipulating the URL in a way that injects malicious script or HTML code.

Recommendations For IBM Cognos Business Intelligence version 10.1 before IF10, apply the IF10 fix to resolve the issue. For IBM Cognos Business Intelligence version 10.1.1 before IF9, apply the IF9 fix to resolve the issue. For IBM Cognos Business Intelligence version 10.2 before IF11, apply the IF11 fix to resolve the issue. For IBM Cognos Business Intelligence version 10.2.1 before IF8, apply the IF8 fix to resolve the issue. For IBM Cognos Business Intelligence version 10.2.1.1 before IF7, apply the IF7 fix to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-6145

Produtos afetados

Ibm Cognos Business Intelligence

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/96915 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg21692267 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6145 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-6145 · Nota de Segurança