PT-2024-2056 · Ibm · Ibm Cognos Command Center

Published 2024-02-28 · Updated 2025-04-23 · CVE-2023-50324

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Cognos Command Center versions 10.2.4.1 through 10.2.5

Description The issue is related to the exposure of information in the IBM Cognos Command Center, which could allow an attacker to obtain details about the application environment and conduct further attacks. This could potentially enable a remote attacker to gain unauthorized access to protected information. The X-AspNet-Version Response Header is specifically exposed, providing insight into the application environment.

Recommendations For versions 10.2.4.1 and 10.2.5, consider restricting access to the X-AspNet-Version Response Header to minimize the risk of exploitation. As a temporary workaround, disabling or limiting the use of this header until a patch is available could help mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-01945

CVE-2023-50324

Affected Products

Ibm Cognos Command Center

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-50324 · Security Note
• https://bdu.fstec.ru/vul/2024-01945 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/275038 · Vendor Advisory
• https://ibm.com/support/pages/node/7112504 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50324 · Vendor Advisory
• https://twitter.com/CVEnew/status/1763391797877747838 · Twitter Post
• https://t.me/cvenotify/72738 · Telegram Post
• https://t.me/cvenotify/119587 · Telegram Post