CVE-2020-4561 - IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions

Back Back to CVE browser

CRITICAL

IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions

Published May 31, 2021

10.0

CRITICAL

CVSS 3.1

EPSS 2.94%

Description

IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who can access a valid CA endpoint to read and write files to the Cognos Analytics system. IBM X-Force ID: 183903.

Affected products

Vendor IBM Product Cognos Analytics Default
n/a
- Version
  11.0
  Status
  affected
  Constraints
  -
- Version
  11.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Cognos Analytics

n/a

Version	Status	Constraints
11.0	affected	-
11.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-829

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25808
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/183903
vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://security.netapp.com/advisory/ntap-20210622-0004/
x_refsource_CONFIRMThird Party Advisory
https://www.ibm.com/support/pages/node/6451705
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25808		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/183903		vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://security.netapp.com/advisory/ntap-20210622-0004/		x_refsource_CONFIRMThird Party Advisory
https://www.ibm.com/support/pages/node/6451705		x_refsource_CONFIRMPatchVendor Advisory