PT-2023-21781 · Ibm · Ibm Cognos Analytics

Maksymilian Kubiak · Published 2023-07-22 · Updated 2023-08-14 · CVE-2023-28530

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics versions 11.1 through 11.2

Description The issue is caused by improper validation of SVG files in Custom Visualizations, leading to stored cross-site scripting. A remote attacker could exploit this to execute scripts in a victim's Web browser within the security context of the hosting Web site, potentially stealing the victim's cookie-based authentication credentials.

Recommendations For versions 11.1 and 11.2, update to a version that properly validates SVG files in Custom Visualizations to prevent stored cross-site scripting. As a temporary workaround, consider restricting the use of Custom Visualizations until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-28530

Affected Products

Ibm Cognos Analytics

References · 7

• https://ibm.com/support/pages/node/7012621 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28530 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28530 · Vendor Advisory
• https://t.me/cvenotify/56445 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/251214 · Note
• https://t.me/cvenotify/54920 · Telegram Post
• https://security.netapp.com/advisory/ntap-20230814-0005 · Note