CVE-2023-47160

CWE-611 — XML External Entity (XXE)3 documents3 sources
Severity
8.2HIGH
EPSS
0.1%
top 82.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Cognos ControllerIBM Controller
Timeline
PublishedFeb 19

Description

IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:LExploitability: 3.9 | Impact: 4.2

Affected Packages4 packages

▶NVDibm/cognos_controller11.0.0 — 11.0.1.4
▶CVEListV5ibm/cognos_controller11.0.0 — 11.0.1
▶CVEListV5ibm/controller11.1.0
▶NVDibm/controller11.1.0

🔴Vulnerability Details

2
CVEList
IBM Cognos Controller XML external entity injection↗2025-02-19
▶
GHSA
GHSA-pw7g-j3c6-jjpp: IBM Cognos Controller 11↗2025-02-19
▶
CVE-2023-47160 (HIGH CVSS 8.2) | IBM Cognos Controller 11.0.0 throug | cvebase.io