CVE-2024-40703

2024-09-2213:15:10

CWE-522

[email protected]

web.nvd.nist.gov

ibm cognos analytics

security vulnerability

api key

local attacker

ios reports

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

Percentile

9.6%

JSON

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and IBM Cognos Analytics Reports for iOS 11.0.0.7 could allow a local attacker to obtain sensitive information in the form of an API key. An attacker could use this information to launch further attacks against affected applications.

Affected configurations

Nvd

Node

ibmcognos_analyticsRange11.2.0–11.2.3

ibmcognos_analyticsRange12.0.0–12.0.3

ibmcognos_analyticsMatch11.2.4-

ibmcognos_analyticsMatch12.0.3-

ibmcognos_analyticsMatch12.0.3interim_fix_1

ibmcognos_analytics_reportsMatch11.0.0.7iphone_os

VendorProductVersionCPE
ibmcognos_analytics*cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*
ibmcognos_analytics11.2.4cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*
ibmcognos_analytics12.0.3cpe:2.3:a:ibm:cognos_analytics:12.0.3:-:*:*:*:*:*:*
ibmcognos_analytics12.0.3cpe:2.3:a:ibm:cognos_analytics:12.0.3:interim_fix_1:*:*:*:*:*:*
ibmcognos_analytics_reports11.0.0.7cpe:2.3:a:ibm:cognos_analytics_reports:11.0.0.7:*:*:*:*:iphone_os:*:*

Vendor	Product	Version	CPE
ibm	cognos_analytics	*	cpe:2.3:a:ibm:cognos_analytics::::::::
ibm	cognos_analytics	11.2.4	cpe:2.3:a:ibm:cognos_analytics:11.2.4:-::::::
ibm	cognos_analytics	12.0.3	cpe:2.3:a:ibm:cognos_analytics:12.0.3:-::::::
ibm	cognos_analytics	12.0.3	cpe:2.3:a:ibm:cognos_analytics:12.0.3:interim_fix_1::::::
ibm	cognos_analytics_reports	11.0.0.7	cpe:2.3:a:ibm:cognos_analytics_reports:11.0.0.7:::::iphone_os::