PT-2025-1037 · Ibm · Ibm Controller+1

Published 2025-01-06 · Updated 2025-01-08 · CVE-2022-22363

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Cognos Controller versions 11.0.0 through 11.0.1 IBM Controller version 11.1.0

Description The issue is related to the error reporting mechanism in IBM Cognos Controller and IBM Controller, which could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. The vulnerability is associated with the reporting mechanism's shortcomings, potentially enabling an attacker to gain unauthorized access to protected information.

Recommendations For IBM Cognos Controller versions 11.0.0 through 11.0.1, consider disabling the detailed technical error messages in the browser until a patch is available. For IBM Controller version 11.1.0, restrict access to error messages to minimize the risk of exploitation. As a temporary workaround, avoid displaying detailed error messages in the browser for all affected versions until the issue is resolved.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BDU:2025-00243

CVE-2022-22363

Affected Products

Ibm Cognos Controller

Ibm Controller

References · 5

• https://ibm.com/support/pages/node/7179163 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22363 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00243 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22363 · Security Note
• https://twitter.com/CVEnew/status/1876890113374114292 · Twitter Post