Lucene search

K
cve[email protected]CVE-2024-25053
HistoryJun 28, 2024 - 7:15 p.m.

CVE-2024-25053

2024-06-2819:15:04
CWE-295
web.nvd.nist.gov
11
ibm cognos analytics
improper certificate validation
ibm planning analytics
x-force id 283364

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM Planning Analytics Data Source Connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between IBM Planning Analytics server and IBM Cognos Analytics server. IBM X-Force ID: 283364.

Affected configurations

Vulners
Node
ibmcognos_analyticsMatch11.2.0
OR
ibmcognos_analyticsMatch11.2.1
OR
ibmcognos_analyticsMatch11.2.2
OR
ibmcognos_analyticsMatch11.2.3
OR
ibmcognos_analyticsMatch11.2.4
OR
ibmcognos_analyticsMatch12.0.0
OR
ibmcognos_analyticsMatch12.0.1
OR
ibmcognos_analyticsMatch12.0.2

CNA Affected

[
  {
    "cpes": [
      "cpe:2.3:a:ibm:cognos_analytics:11.2.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics:11.2.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics:11.2.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics:11.2.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics:11.2.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics:12.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics:12.0.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics:12.0.2:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "Cognos Analytics",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2"
      }
    ]
  }
]

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

Related for CVE-2024-25053