Lucene search

IbmCVE-2023-38735

HistoryOct 22, 2023 - 2:15 a.m.

CVE-2023-38735

2023-10-2202:15:07

CWE-287

ibm

web.nvd.nist.gov

ibm

cognos

dashboards

cloud pak

data

4.7.0

remote code execution

vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

21.8%

JSON

IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a victim to a phishing site. IBM X-Force ID: 262482.

Affected configurations

Nvd

Vulners

Node

ibmcognos_dashboards_on_cloud_pak_for_dataMatch4.7.0

VendorProductVersionCPE
ibmcognos_dashboards_on_cloud_pak_for_data4.7.0cpe:2.3:a:ibm:cognos_dashboards_on_cloud_pak_for_data:4.7.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	cognos_dashboards_on_cloud_pak_for_data	4.7.0	cpe:2.3:a:ibm:cognos_dashboards_on_cloud_pak_for_data:4.7.0:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Cognos Dashboards on Cloud Pak for Data",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "4.7.0"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/262482

www.ibm.com/support/pages/node/7031207

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

21.8%

JSON

Related for CVE-2023-38735