IBM Cognos 11.0 Content Spoofing

2016-06-03T00:00:00
ID PACKETSTORM:137306
Type packetstorm
Reporter Sonal Moon
Modified 2016-06-03T00:00:00

Description

                                        
                                            `/*  
Content Spoofing Vulnerability in IBM Cognos Analytics Applications  
Advisory 5190  
Patch Release - 30 May 2016  
Public Release - 03 June 2016  
CVE-2016-0398  
The IBM Security Bulletins associated with this CVE have been published at the following URLs:  
IBM Cognos Analytics 11.0 http://www.ibm.com/support/docview.wss?uid=swg21977070IBM Cognos Analytics 10.x http://www.ibm.com/support/docview.wss?uid=swg21983247  
Products or solutions and versions affected - IBM Cognos 10.x, 11.0  
Summary - IBM Cognos Analytics 10.x and 11.0 applications are affected by Content Spoofing vulnerability which is an attack technique that allows an attacker to inject a malicious payload that is later misrepresented as legitimate content of a web application. This does not require any authentication.  
Payload   
https://TargetURL/cognos1021/cgi-bin/cognos.cgi?b_action=icd&pathinfo=Your_Text_Here  
*/  
Regards,Sonal Moon  
`