CVE-2021-38945

Published: Jun 24, 2022Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation. IBM X-Force ID: 211238.

Affected (9)

Products: Ibm: Cognos Analytics · Netapp: Oncommand Insight

1 product

Cognos Analytics

1 product

Oncommand Insight

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Ibm Cognos Analytics	From 11.1.0 to 11.1.7
Ibm Cognos Analytics	Version 11.1.7
Ibm Cognos Analytics	Version 11.1.7 fixpack1
Ibm Cognos Analytics	Version 11.1.7 fixpack2
Ibm Cognos Analytics	Version 11.1.7 fixpack3
Ibm Cognos Analytics	Version 11.1.7 fixpack4
Ibm Cognos Analytics	Version 11.2.0
Ibm Cognos Analytics	Version 11.2.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Oncommand Insight	All versions

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (6)

https://exchange.xforce.ibmcloud.com/vulnerabilities/211238

Source: psirt@us.ibm.com

VDB EntryVendor Advisory

https://security.netapp.com/advisory/ntap-20220729-0002/

Source: psirt@us.ibm.com

Third Party Advisory

https://www.ibm.com/support/pages/node/6597241

Source: psirt@us.ibm.com

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/211238

Source: af854a3a-2127-422b-91ae-364da2661108

VDB EntryVendor Advisory

https://security.netapp.com/advisory/ntap-20220729-0002/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.ibm.com/support/pages/node/6597241

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.