CVE-2023-35011

Опубликовано: 16 авг. 2023

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 257705.

Ссылки

https://exchange.xforce.ibmcloud.com/vulnerabilities/257705
VDB Entry
Vendor Advisory
https://security.netapp.com/advisory/ntap-20230921-0005/
https://security.netapp.com/advisory/ntap-20240621-0005/
https://www.ibm.com/support/pages/node/7026692
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/257705
VDB Entry
Vendor Advisory
https://security.netapp.com/advisory/ntap-20230921-0005/
https://security.netapp.com/advisory/ntap-20240621-0005/
https://www.ibm.com/support/pages/node/7026692
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*

Версия от 11.1.0 (включая) до 11.1.7 (исключая)

cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*

Версия от 11.2.0 (включая) до 11.2.4 (исключая)

cpe:2.3:a:ibm:cognos_analytics:11.1.7:-:*:*:*:*:*:*

cpe:2.3:a:ibm:cognos_analytics:11.1.7:interimfix1:*:*:*:*:*:*

cpe:2.3:a:ibm:cognos_analytics:11.1.7:interimfix2:*:*:*:*:*:*

cpe:2.3:a:ibm:cognos_analytics:11.1.7:interimfix3:*:*:*:*:*:*

cpe:2.3:a:ibm:cognos_analytics:11.1.7:interimfix4:*:*:*:*:*:*

cpe:2.3:a:ibm:cognos_analytics:11.1.7:interimfix5:*:*:*:*:*:*

cpe:2.3:a:ibm:cognos_analytics:11.1.7:interimfix6:*:*:*:*:*:*

cpe:2.3:a:ibm:cognos_analytics:11.1.7:interimfix7:*:*:*:*:*:*

cpe:2.3:a:ibm:cognos_analytics:11.1.7:interimfix8:*:*:*:*:*:*

cpe:2.3:a:ibm:cognos_analytics:11.1.7:interimfix9:*:*:*:*:*:*

cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*

cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack1:*:*:*:*:*:*

EPSS

Процентиль: 17%

0.00053

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-918

Связанные уязвимости

GHSA-fchh-435h-cf8h