PT-2022-6871 · Ibm · Ibm Cognos Analytics

Published 2022-06-24 · Updated 2023-08-08 · CVE-2021-29768

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics versions 11.1.7 through 11.2.1

Description The issue is related to a lack of protection for service data in IBM Cognos Analytics, which could allow a low-level user to obtain sensitive information from the details of the 'Cloud Storage' page that they should not have access to. This could potentially be exploited by a remote attacker to gain access to protected information.

Recommendations For versions 11.1.7, 11.2.0, and 11.2.1, consider restricting access to the 'Cloud Storage' page until a fix is available. As a temporary workaround, consider disabling the Cloud Storage feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-05263

CVE-2021-29768

Affected Products

Ibm Cognos Analytics

References · 8

• https://bdu.fstec.ru/vul/2023-05263 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29768 · Vendor Advisory
• https://ibm.com/support/pages/node/6597241 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/202682 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29768 · Security Note
• https://t.me/cibsecurity/45110 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220729-0002 · Note
• https://ibm.com/blogs/psirt/security-bulletin-ibm-cognos-analytics-has-addressed-multiple-vulnerabilities-8 · Note