Lucene search

IbmCVE-2024-40703

HistorySep 22, 2024 - 1:15 p.m.

CVE-2024-40703

2024-09-2213:15:10

CWE-522

ibm

web.nvd.nist.gov

ibm cognos analytics

api key

local attacker

ios 11.0.0.7

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.7

Confidence

Low

EPSS

Percentile

9.6%

JSON

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and IBM Cognos Analytics Reports for iOS 11.0.0.7 could allow a local attacker to obtain sensitive information in the form of an API key. An attacker could use this information to launch further attacks against affected applications.

Affected configurations

Nvd

Vulners

Node

ibmcognos_analyticsRange11.2.0–11.2.3

ibmcognos_analyticsRange12.0.0–12.0.3

ibmcognos_analyticsMatch11.2.4-

ibmcognos_analyticsMatch12.0.3-

ibmcognos_analyticsMatch12.0.3interim_fix_1

ibmcognos_analytics_reportsMatch11.0.0.7iphone_os

VendorProductVersionCPE
ibmcognos_analytics*cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*
ibmcognos_analytics11.2.4cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*
ibmcognos_analytics12.0.3cpe:2.3:a:ibm:cognos_analytics:12.0.3:-:*:*:*:*:*:*
ibmcognos_analytics12.0.3cpe:2.3:a:ibm:cognos_analytics:12.0.3:interim_fix_1:*:*:*:*:*:*
ibmcognos_analytics_reports11.0.0.7cpe:2.3:a:ibm:cognos_analytics_reports:11.0.0.7:*:*:*:*:iphone_os:*:*

Vendor	Product	Version	CPE
ibm	cognos_analytics	*	cpe:2.3:a:ibm:cognos_analytics::::::::
ibm	cognos_analytics	11.2.4	cpe:2.3:a:ibm:cognos_analytics:11.2.4:-::::::
ibm	cognos_analytics	12.0.3	cpe:2.3:a:ibm:cognos_analytics:12.0.3:-::::::
ibm	cognos_analytics	12.0.3	cpe:2.3:a:ibm:cognos_analytics:12.0.3:interim_fix_1::::::
ibm	cognos_analytics_reports	11.0.0.7	cpe:2.3:a:ibm:cognos_analytics_reports:11.0.0.7:::::iphone_os::

CNA Affected

[
  {
    "cpes": [
      "cpe:2.3:a:ibm:cognos_analytics:11.2.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics:11.2.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics:11.2.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics:11.2.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics:11.2.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics:12.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics:12.0.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics:12.0.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics:12.0.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cognos_analytics_reports:11.0.0.7:*:*:*:*:ios:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "Cognos Analytics",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "iOS"
    ],
    "product": "Cognos Analytics Reports",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "11.0.0.7"
      }
    ]
  }
]

References

www.ibm.com/support/pages/node/7160700

www.ibm.com/support/pages/node/7168038

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.7

Confidence

Low

EPSS

Percentile

9.6%

JSON

Related for CVE-2024-40703