PT-2021-3248 · Ibm · Ibm Cognos Analytics

Published 2021-05-31 · Updated 2021-12-01 · CVE-2019-4730

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics versions 11.0 through 11.1

Description The issue is related to the incorrect restriction of XML links to external objects, which can be exploited by a remote attacker to impact the confidentiality and availability of protected information. This can lead to sensitive information exposure or memory resource consumption.

Recommendations For versions 11.0 and 11.1, consider disabling XML processing until a patch is available to prevent exploitation. Restrict access to sensitive information to minimize the risk of exposure. As a temporary workaround, limit the amount of memory resources available to the application to prevent consumption by an attacker. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2021-02967

CVE-2019-4730

Affected Products

Ibm Cognos Analytics

References · 9

• https://bdu.fstec.ru/vul/2021-02967 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-4730 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/172533 · Vendor Advisory
• https://ibm.com/support/pages/node/6451705 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-4730 · Vendor Advisory
• https://ibm.com/blogs/psirt/security-bulletin-ibm-cognos-analytics-has-addressed-multiple-vulnerabilities-3 · Note
• https://security.netapp.com/advisory/ntap-20210622-0004 · Note
• https://t.me/cvenotify/24048 · Telegram Post
• https://t.me/cvenotify/15571 · Telegram Post