PT-2019-16947 · Ibm · Ibm Cognos Controller

Published 2019-09-17 · Updated 2022-12-09 · CVE-2019-4171

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Cognos Controller versions 10.3.0 through 10.4.1

Description The issue allows an attacker to obtain sensitive information using man-in-the-middle techniques because it does not set the secure attribute on authorization tokens or session cookies.

Recommendations For versions 10.3.0 through 10.4.1, consider implementing additional security measures to protect against man-in-the-middle attacks, such as using HTTPS to encrypt communication and verifying the authenticity of cookies and tokens. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2019-4171

Affected Products

Ibm Cognos Controller

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/158876 · Vendor Advisory
• https://ibm.com/support/pages/security-bulletin-security-vulnerabilties-exist-ibm-cognos-controller · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4171 · Security Note
• https://osv.dev/vulnerability/CVE-2019-4171 · Vendor Advisory