CVE-2023-32344

IBM Cognos Analytics cross-site request forgery

CVSS 4.3 MEDIUMEPSS 0.4%CWE-352

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 4.3EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

24 Feb 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path. IBM X-Force ID: 255898.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

IBM · Cognos Analytics

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/255898 https://security.netapp.com/advisory/ntap-20240405-0002/https://security.netapp.com/advisory/ntap-20240621-0006/https://www.ibm.com/support/pages/node/7123154