CVE-2023-32344 — Cross-Site Request Forgery in IBM Cognos Analytics

CWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.0%
top 90.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Cognos Analytics
Timeline
PublishedFeb 26

Description

IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path. IBM X-Force ID: 255898.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDibm/cognos_analytics11.1.1 — 11.1.7+5

🔴Vulnerability Details

2
GHSA
GHSA-fxmj-6xv8-f3m7: IBM Cognos Analytics 11↗2024-02-26
▶
CVEList
IBM Cognos Analytics cross-site request forgery↗2024-02-24
▶
CVE-2023-32344 — Cross-Site Request Forgery in IBM | cvebase