PT-2022-2573 · Ibm · Ibm Cognos Controller

Published 2022-01-20 · Updated 2022-01-27 · CVE-2020-4879

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Cognos Controller versions 10.4.0 through 10.4.2

Description The issue is related to improper validation of authentication cookies, which could allow a remote attacker to bypass security restrictions. This may impact the confidentiality, integrity, and availability of protected information.

Recommendations For versions 10.4.0 through 10.4.2, consider disabling the use of authentication cookies until a patch is available. As a temporary workaround, restrict access to sensitive areas of the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2022-03017

CVE-2020-4879

Affected Products

Ibm Cognos Controller

References · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/190847 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4879 · Security Note
• https://ibm.com/support/pages/node/6509856 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03017 · Security Note
• https://osv.dev/vulnerability/CVE-2020-4879 · Vendor Advisory
• https://t.me/cibsecurity/36036 · Telegram Post
• https://ibm.com/blogs/psirt/security-bulletin-ibm-cognos-controller-has-addressed-multiple-vulnerabilities · Note