CVE-2020-4301

Published: Sep 1, 2022Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 176609.

Affected (8)

Products: Ibm: Cognos Analytics · Netapp: Oncommand Insight

1 product

Cognos Analytics

1 product

Oncommand Insight

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Ibm Cognos Analytics	From 11.1.0 to 11.1.7
Ibm Cognos Analytics	From 11.2.0 to 11.2.3
Ibm Cognos Analytics	Version 11.1.7
Ibm Cognos Analytics	Version 11.1.7 fixpack1
Ibm Cognos Analytics	Version 11.1.7 fixpack2
Ibm Cognos Analytics	Version 11.1.7 fixpack3
Ibm Cognos Analytics	Version 11.1.7 fixpack4

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Oncommand Insight	All versions

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (6)

https://exchange.xforce.ibmcloud.com/vulnerabilities/176609

Source: psirt@us.ibm.com

VDB EntryVendor Advisory

https://security.netapp.com/advisory/ntap-20221014-0005/

Source: psirt@us.ibm.com

Third Party Advisory

https://www.ibm.com/support/pages/node/6615285

Source: psirt@us.ibm.com

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/176609

Source: af854a3a-2127-422b-91ae-364da2661108

VDB EntryVendor Advisory

https://security.netapp.com/advisory/ntap-20221014-0005/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.ibm.com/support/pages/node/6615285

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.