PT-2025-1352 · Ibm · Ibm Controller+1

Published 2020-12-17 · Updated 2025-07-03 · CVE-2021-20455

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Cognos Controller versions 11.0.0 through 11.0.1 IBM Controller version 11.1.0

Description The issue allows a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. The vulnerability is related to shortcomings in the error reporting mechanism, which could enable an attacker to gain unauthorized access to protected information.

Recommendations For IBM Cognos Controller versions 11.0.0 through 11.0.1, consider disabling detailed technical error messages in the browser to minimize the risk of exploitation. For IBM Controller version 11.1.0, restrict access to error messages to prevent unauthorized information disclosure. As a temporary workaround, consider implementing additional logging and monitoring to detect potential exploitation attempts until a patch is available.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BDU:2025-01568

CVE-2021-20455

Affected Products

Ibm Cognos Controller

Ibm Controller

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-20455 · Security Note
• https://ibm.com/support/pages/node/7179163 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20455 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01568 · Security Note
• https://vuldb.com/?id.290603 · Note
• https://t.me/cvenotify/127666 · Telegram Post
• https://twitter.com/CVEnew/status/1876662290163884078 · Twitter Post