CVE-2023-32344

IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path. IBM X-Force ID: 255898.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/255898	VDB Entry Vendor Advisory
https://security.netapp.com/advisory/ntap-20240405-0002/	Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0006/	Third Party Advisory
https://www.ibm.com/support/pages/node/7123154	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/255898	VDB Entry Vendor Advisory
https://security.netapp.com/advisory/ntap-20240405-0002/	Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0006/	Third Party Advisory
https://www.ibm.com/support/pages/node/7123154	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:a:ibm:cognos_analytics::::::::
	cpe:2.3:a:ibm:cognos_analytics::::::::
	cpe:2.3:a:ibm:cognos_analytics:11.1.7:-::::::
	cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack1::::::
	cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack2::::::
	cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack3::::::
	cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack4::::::
	cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack5::::::
	cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack6::::::
	cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack7::::::
	cpe:2.3:a:ibm:cognos_analytics:11.2.4:-::::::
	cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack1::::::
	cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack2::::::
	cpe:2.3:a:ibm:cognos_analytics:12.0.0:::::::*
	cpe:2.3:a:ibm:cognos_analytics:12.0.1:::::::*

History

No history.

Information

Published : 2024-02-26 16:27

Updated : 2024-12-17 18:55

NVD link : CVE-2023-32344

Mitre link : CVE-2023-32344

CVE.ORG link : CVE-2023-32344

JSON object : View

Products Affected

ibm

cognos_analytics

netapp

oncommand_insight

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2023-32344", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-02-26T16:27:46.313", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/255898", "tags": ["VDB Entry", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://security.netapp.com/advisory/ntap-20240405-0002/", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://security.netapp.com/advisory/ntap-20240621-0006/", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.ibm.com/support/pages/node/7123154", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/255898", "tags": ["VDB Entry", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20240405-0002/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20240621-0006/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.ibm.com/support/pages/node/7123154", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path. IBM X-Force ID: 255898."}, {"lang": "es", "value": "IBM Cognos Analytics 11.1.7, 11.2.4 y 12.0.0 es vulnerable al secuestro de acciones de formulario, donde es posible modificar la acci\u00f3n de formulario para hacer referencia a una ruta arbitraria. ID de IBM X-Force: 255898."}], "lastModified": "2024-12-17T18:55:38.543", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A20C428C-F583-4E8B-A9E0-F8E04F9692D6", "versionEndExcluding": "11.1.7", "versionStartIncluding": "11.1.1"}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA7F561D-2D45-4BDB-AE84-1BD057DC9930", "versionEndExcluding": "11.2.4", "versionStartIncluding": "11.2.0"}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.1.7:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6680448A-C3B3-4FEE-A500-974681D3E731"}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2E66D31-A2CC-4F06-89D3-9A881EADE0FD"}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A76630E7-2DEB-4992-A671-85729B80E46B"}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38BDC609-EA7D-4C15-868A-EC8D8FFD3AF9"}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCF5213D-4BB1-4109-8B1B-5CA129819692"}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3F972B5-E6C3-4D95-8C61-B9F90C1BAC36"}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AA6713E-8BB8-476E-AE6F-E42645B1556B"}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D934D062-F4AE-4AFF-88FA-599A1E68E8BE"}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1D81212-AFFE-4A73-AAC1-E558973FC452"}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07DC144D-62FC-4808-A77A-642871C1F8FC"}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A61B920-B490-48A8-BF00-13B8854683FD"}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:12.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "210893AF-E67A-49C1-80FC-59A1F1C1B32F"}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:12.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CFDD4A63-2F81-48C8-8400-E1BE15C8EA3D"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}