Security Bulletin: IBM Sterling Control Center vulnerable to arbitrary file upload and sensitive information exposure due to IBM Cognos Analytics (CVE-2021-38945, CVE-2021-29768)

Summary IBM Cognos Analytics is shipped with IBM Sterling Control Center. To address multiple vulnerabilities, IBM Sterling Control Center now includes IBM Cognos Analytics 11.1.7.5. Vulnerability Details CVEID:CVE-2021-38945 DESCRIPTION: IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allo...

CVE-2021-29768

CVE-2021-29768 affects IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1, allowing a low-privilege user to obtain sensitive information from the details of the Cloud Storage page due to faulty access controls. Remediation per connected IBM/NCSC sources: upgrade to Cognos Analytics 11.2.2 or apply 1...