cve-2023-32344
Vulnerability from cvelistv5
Published
2024-02-24 15:29
Modified
2024-08-02 15:10
Severity ?
EPSS score ?
Summary
IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path. IBM X-Force ID: 255898.
References
▼ | URL | Tags | |
---|---|---|---|
psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/255898 | VDB Entry, Vendor Advisory | |
psirt@us.ibm.com | https://security.netapp.com/advisory/ntap-20240405-0002/ | Third Party Advisory | |
psirt@us.ibm.com | https://security.netapp.com/advisory/ntap-20240621-0006/ | Third Party Advisory | |
psirt@us.ibm.com | https://www.ibm.com/support/pages/node/7123154 | Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/255898 | VDB Entry, Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://security.netapp.com/advisory/ntap-20240405-0002/ | Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://security.netapp.com/advisory/ntap-20240621-0006/ | Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://www.ibm.com/support/pages/node/7123154 | Vendor Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | IBM | Cognos Analytics |
Version: e |
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-32344", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-02-26T17:42:02.722942Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-05T17:22:00.245Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T15:10:24.890Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://www.ibm.com/support/pages/node/7123154" }, { "tags": [ "vdb-entry", "x_transferred" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/255898" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20240405-0002/" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20240621-0006/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Cognos Analytics", "vendor": "IBM", "versions": [ { "status": "affected", "version": "e" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path. IBM X-Force ID: 255898." } ], "value": "IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path. IBM X-Force ID: 255898." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-02-24T15:29:33.526Z", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://www.ibm.com/support/pages/node/7123154" }, { "tags": [ "vdb-entry" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/255898" }, { "url": "https://security.netapp.com/advisory/ntap-20240405-0002/" }, { "url": "https://security.netapp.com/advisory/ntap-20240621-0006/" } ], "source": { "discovery": "UNKNOWN" }, "title": "IBM Cognos Analytics cross-site request forgery", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2023-32344", "datePublished": "2024-02-24T15:29:33.526Z", "dateReserved": "2023-05-08T18:32:52.655Z", "dateUpdated": "2024-08-02T15:10:24.890Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2023-32344\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2024-02-26T16:27:46.313\",\"lastModified\":\"2024-12-17T18:55:38.543\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path. IBM X-Force ID: 255898.\"},{\"lang\":\"es\",\"value\":\"IBM Cognos Analytics 11.1.7, 11.2.4 y 12.0.0 es vulnerable al secuestro de acciones de formulario, donde es posible modificar la acci\u00f3n de formulario para hacer referencia a una ruta arbitraria. ID de IBM X-Force: 255898.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1BE6C1F-2565-4E97-92AA-16563E5660A5\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.1.1\",\"versionEndExcluding\":\"11.1.7\",\"matchCriteriaId\":\"A20C428C-F583-4E8B-A9E0-F8E04F9692D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.2.0\",\"versionEndExcluding\":\"11.2.4\",\"matchCriteriaId\":\"FA7F561D-2D45-4BDB-AE84-1BD057DC9930\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cognos_analytics:11.1.7:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"6680448A-C3B3-4FEE-A500-974681D3E731\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2E66D31-A2CC-4F06-89D3-9A881EADE0FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A76630E7-2DEB-4992-A671-85729B80E46B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack3:*:*:*:*:*:*\",\"matchCriteriaId\":\"38BDC609-EA7D-4C15-868A-EC8D8FFD3AF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack4:*:*:*:*:*:*\",\"matchCriteriaId\":\"BCF5213D-4BB1-4109-8B1B-5CA129819692\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack5:*:*:*:*:*:*\",\"matchCriteriaId\":\"C3F972B5-E6C3-4D95-8C61-B9F90C1BAC36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack6:*:*:*:*:*:*\",\"matchCriteriaId\":\"0AA6713E-8BB8-476E-AE6F-E42645B1556B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack7:*:*:*:*:*:*\",\"matchCriteriaId\":\"D934D062-F4AE-4AFF-88FA-599A1E68E8BE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1D81212-AFFE-4A73-AAC1-E558973FC452\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack1:*:*:*:*:*:*\",\"matchCriteriaId\":\"07DC144D-62FC-4808-A77A-642871C1F8FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A61B920-B490-48A8-BF00-13B8854683FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cognos_analytics:12.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"210893AF-E67A-49C1-80FC-59A1F1C1B32F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cognos_analytics:12.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CFDD4A63-2F81-48C8-8400-E1BE15C8EA3D\"}]}]}],\"references\":[{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/255898\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"VDB Entry\",\"Vendor Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20240405-0002/\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20240621-0006/\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.ibm.com/support/pages/node/7123154\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/255898\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"VDB Entry\",\"Vendor Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20240405-0002/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20240621-0006/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.ibm.com/support/pages/node/7123154\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.