CVE-2022-38708 — Server-Side Request Forgery in IBM Cognos Analytics

CWE-918 — Server-Side Request Forgery3 documents3 sources
Severity
9.1CRITICALNVD
CNA6.5
EPSS
0.2%
top 52.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Cognos Analytics
Timeline
PublishedDec 19

Description

IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 234180.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages2 packages

▶NVDibm/cognos_analytics11.1.0 — 11.1.7+2
▶CVEListV5ibm/cognos_analytics11.1.7 11.2.0, 11.2.1

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
CVEList
IBM Cognos Analytics server-side request forgery↗2022-12-19
▶
GHSA
GHSA-cpf6-q438-6grj: IBM Cognos Analytics 11↗2022-12-19
▶
CVE-2022-38708 — Server-Side Request Forgery in IBM | cvebase