CVE-2016-3037

Published: Apr 17, 2017Modified: May 13, 2026

5.7

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.1 / Impact: 3.6

Source: NVD

Description

IBM Cognos TM1 10.1 and 10.2 provides a service to return the victim's password with a valid session key. An authenticated attacker with user interaction could obtain this sensitive information. IBM X-Force ID: 114613.

Affected (3)

Products: Ibm: Cognos Business Intelligence

Ibm

1 product

Cognos Business Intelligence

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Ibm Cognos Business Intelligence	Version 10.1
Ibm Cognos Business Intelligence	Version 10.2.2
Ibm Cognos Business Intelligence	Version 10.2

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

http://www.ibm.com/support/docview.wss?uid=swg21999649

Source: psirt@us.ibm.com

PatchVendor Advisory

http://www.securityfocus.com/bid/97917

Source: psirt@us.ibm.com

Third Party AdvisoryVDB Entry

http://www.ibm.com/support/docview.wss?uid=swg21999649

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.securityfocus.com/bid/97917

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.