CVE-2023-32344

IBM Cognos Analytics cross-site request forgery

CVSS 4.3 MEDIUMEPSS 0.4%CWE-352

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 4.3EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

24 feb 2024Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path. IBM X-Force ID: 255898.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Productos afectados

IBM · Cognos Analytics

Referencias

https://exchange.xforce.ibmcloud.com/vulnerabilities/255898 https://security.netapp.com/advisory/ntap-20240405-0002/https://security.netapp.com/advisory/ntap-20240621-0006/https://www.ibm.com/support/pages/node/7123154