PT-2024-12762 · Ibm · Ibm Cognos Controller

Published 2024-05-03 · Updated 2025-01-14 · CVE-2023-38724

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Cognos Controller versions 10.4.1 through 11.0.0

Description The issue allows a remote attacker to send specially crafted SQL statements, which could enable the attacker to view, add, modify, or delete information in the back-end database. This is a result of a SQL injection vulnerability.

Recommendations For versions 10.4.1 through 11.0.0, update the affected SQL Handler component as soon as possible to mitigate the risk of remote exploit.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-38724

Affected Products

Ibm Cognos Controller

References · 7

• https://ibm.com/support/pages/node/7149876 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38724 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/262183 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1786496444112769371 · Twitter Post
• https://twitter.com/CVEnew/status/1786770955701813312 · Twitter Post
• https://twitter.com/oktsec/status/1786509254876135490 · Twitter Post