{"containers": {"cna": {"affected": [{"product": "Cognos Controller", "vendor": "IBM", "versions": [{"status": "affected", "version": "10.2.1"}, {"status": "affected", "version": "10.2.0"}, {"status": "affected", "version": "10.3.1"}, {"status": "affected", "version": "10.3.0"}, {"status": "affected", "version": "10.4.0"}]}], "datePublic": "2019-06-13T00:00:00", "descriptions": [{"lang": "en", "value": "IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to obtain sensitive information, caused by a flaw in the HTTP OPTIONS method, aka Optionsbleed. By sending an OPTIONS HTTP request, a remote attacker could exploit this vulnerability to read secret data from process memory and obtain sensitive information. IBM X-Force ID: 158878."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "exploitCodeMaturity": "UNPROVEN", "integrityImpact": "NONE", "privilegesRequired": "LOW", "remediationLevel": "OFFICIAL_FIX", "reportConfidence": "CONFIRMED", "scope": "UNCHANGED", "temporalScore": 5.7, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.0/A:N/UI:N/PR:L/I:N/S:U/AC:L/C:H/AV:N/RC:C/E:U/RL:O", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Obtain Information", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-06-17T15:10:22", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.ibm.com/support/docview.wss?uid=ibm10886913"}, {"name": "ibm-cognos-cve20194173-info-disc (158878)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158878"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "DATE_PUBLIC": "2019-06-13T00:00:00", "ID": "CVE-2019-4173", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Cognos Controller", "version": {"version_data": [{"version_value": "10.2.1"}, {"version_value": "10.2.0"}, {"version_value": "10.3.1"}, {"version_value": "10.3.0"}, {"version_value": "10.4.0"}]}}]}, "vendor_name": "IBM"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to obtain sensitive information, caused by a flaw in the HTTP OPTIONS method, aka Optionsbleed. By sending an OPTIONS HTTP request, a remote attacker could exploit this vulnerability to read secret data from process memory and obtain sensitive information. IBM X-Force ID: 158878."}]}, "impact": {"cvssv3": {"BM": {"A": "N", "AC": "L", "AV": "N", "C": "H", "I": "N", "PR": "L", "S": "U", "UI": "N"}, "TM": {"E": "U", "RC": "C", "RL": "O"}}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Obtain Information"}]}]}, "references": {"reference_data": [{"name": "http://www.ibm.com/support/docview.wss?uid=ibm10886913", "refsource": "CONFIRM", "title": "IBM Security Bulletin 886913 (Cognos Controller)", "url": "http://www.ibm.com/support/docview.wss?uid=ibm10886913"}, {"name": "ibm-cognos-cve20194173-info-disc (158878)", "refsource": "XF", "title": "X-Force Vulnerability Report", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158878"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T19:33:37.532Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.ibm.com/support/docview.wss?uid=ibm10886913"}, {"name": "ibm-cognos-cve20194173-info-disc (158878)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158878"}]}]}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2019-4173", "datePublished": "2019-06-17T15:10:22.837762Z", "dateReserved": "2019-01-03T00:00:00", "dateUpdated": "2024-09-17T00:37:17.811Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:cognos_controller:10.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "C5E51AA2-19DE-4FC5-A126-ACA169942521", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cognos_controller:10.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "2A39451D-1A06-4082-99E9-C86DBA797050", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cognos_controller:10.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "7B9021EE-6BDF-4722-A7EA-E984A21684A7", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cognos_controller:10.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "F544128B-455B-4485-A98F-4DB751925B36", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cognos_controller:10.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "8284ECE5-3938-47B2-99B6-6D3B9ECB8C82", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to obtain sensitive information, caused by a flaw in the HTTP OPTIONS method, aka Optionsbleed. By sending an OPTIONS HTTP request, a remote attacker could exploit this vulnerability to read secret data from process memory and obtain sensitive information. IBM X-Force ID: 158878."}, {"lang": "es", "value": "IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1 y 10.4.0 podr\u00eda permitirle a un atacante remoto obtener informaci\u00f3n confidencial, causada por un fallo en el m\u00e9todo de HTTP OPTIONS, tambi\u00e9n conocido como Opcionesbleed. Al enviar una solicitud HTTP OPTIONS, un atacante remoto podr\u00eda aprovechar esta vulnerabilidad para leer datos secretos de la memoria de proceso y obtener informaci\u00f3n confidencial. ID de IBM X-Force: 158878."}], "id": "CVE-2019-4173", "lastModified": "2023-02-03T20:41:09.010", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-06-17T15:15:12.520", "references": [{"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=ibm10886913"}, {"source": "psirt@us.ibm.com", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158878"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}