PT-2022-27041 · Ibm · Ibm Cognos Analytics

Published 2022-12-19 · Updated 2022-12-23 · CVE-2022-43887

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics versions 11.1.7 through 11.2.1

Description The issue concerns sensitive information exposure by passing API keys to log files. If these keys contain sensitive information, it could lead to further attacks.

Recommendations For IBM Cognos Analytics versions 11.1.7 through 11.2.1, consider restricting access to log files to minimize the risk of sensitive information exposure. As a temporary workaround, review log file configurations to prevent API keys from being written to logs until a more permanent solution is available.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2022-43887

Affected Products

Ibm Cognos Analytics

References · 5

• https://osv.dev/vulnerability/CVE-2022-43887 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43887 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/240450 · Vendor Advisory
• https://ibm.com/support/pages/node/6841801 · Vendor Advisory
• https://t.me/cibsecurity/54931 · Telegram Post