PT-2020-17985 · Ibm+1 · Ibm Cognos Analytics+1

Published 2020-10-12 · Updated 2021-07-21 · CVE-2020-4302

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics versions 11.0 through 11.1

Description The issue allows a remote attacker to execute arbitrary code on the system due to a CSV injection. This can be exploited by persuading a victim to open a specially-crafted Excel file, which could then execute arbitrary code on the system.

Recommendations For IBM Cognos Analytics versions 11.0 through 11.1, consider avoiding the use of CSV files from untrusted sources until a fix is available. As a temporary workaround, restrict access to Excel files from unknown origins to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2020-4302

Affected Products

Office Excel

Ibm Cognos Analytics

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-4302 · Security Note
• https://ibm.com/support/pages/node/6346922 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4302 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/176610 · Vendor Advisory