CVE-2021-39009 - Vulnerability Details

Vendors	Products
Ibm	Cognos Analytics
Netapp	Oncommand Insight

Link	Providers
https://exchange.xforce.ibmcloud.com/vulnerabilities/213554
https://security.netapp.com/advisory/ntap-20221014-0005/
https://www.ibm.com/support/pages/node/6615285

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-39009", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "datePublished": "2022-09-01T19:00:27.281805Z", "dateUpdated": "2024-09-17T04:10:04.107Z", "dateReserved": "2021-08-16T00:00:00"}, "containers": {"cna": {"datePublic": "2022-08-31T00:00:00", "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2022-10-14T00:00:00"}, "descriptions": [{"lang": "en", "value": "IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 213554."}], "affected": [{"vendor": "IBM", "product": "Cognos Analytics", "versions": [{"version": "11.2.0", "status": "affected"}, {"version": "11.1.7", "status": "affected"}, {"version": "11.2.1", "status": "affected"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/6615285"}, {"name": "ibm-cognos-cve202139009-info-disc (213554)", "tags": ["vdb-entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/213554"}, {"url": "https://security.netapp.com/advisory/ntap-20221014-0005/"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/C:H/AV:L/AC:L/I:N/S:U/A:N/UI:N/PR:H/RL:O/E:U/RC:C", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "exploitCodeMaturity": "UNPROVEN", "remediationLevel": "OFFICIAL_FIX", "reportConfidence": "CONFIRMED", "baseScore": 4.4, "temporalScore": 3.9, "baseSeverity": "MEDIUM", "temporalSeverity": "LOW"}}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Obtain Information"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T01:58:17.684Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.ibm.com/support/pages/node/6615285", "tags": ["x_transferred"]}, {"name": "ibm-cognos-cve202139009-info-disc (213554)", "tags": ["vdb-entry", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/213554"}, {"url": "https://security.netapp.com/advisory/ntap-20221014-0005/", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2021-39009 (string)

assignerOrgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

assignerShortName : ibm (string)

datePublished : 2022-09-01T19:00:27.281805Z (string)

dateUpdated : 2024-09-17T04:10:04.107Z (string)

dateReserved : 2021-08-16T00:00:00 (string)

}

containers : { »

cna : { »

datePublic : 2022-08-31T00:00:00 (string)

providerMetadata : { »

orgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

shortName : ibm (string)

dateUpdated : 2022-10-14T00:00:00 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 213554. (string)

}

]

affected : [ »

0 : { »

vendor : IBM (string)

product : Cognos Analytics (string)

versions : [ »

0 : { »

version : 11.2.0 (string)

status : affected (string)

}

1 : { »

version : 11.1.7 (string)

status : affected (string)

}

2 : { »

version : 11.2.1 (string)

status : affected (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.ibm.com/support/pages/node/6615285 (string)

}

1 : { »

name : ibm-cognos-cve202139009-info-disc (213554) (string)

tags : [ »

0 : vdb-entry (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/213554 (string)

}

2 : { »

url : https://security.netapp.com/advisory/ntap-20221014-0005/ (string)

}

]

metrics : [ »

0 : { »

cvssV3_0 : { »

version : 3.0 (string)

vectorString : CVSS:3.0/C:H/AV:L/AC:L/I:N/S:U/A:N/UI:N/PR:H/RL:O/E:U/RC:C (string)

attackVector : LOCAL (string)

attackComplexity : LOW (string)

privilegesRequired : HIGH (string)

userInteraction : NONE (string)

scope : UNCHANGED (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

availabilityImpact : NONE (string)

exploitCodeMaturity : UNPROVEN (string)

remediationLevel : OFFICIAL_FIX (string)

reportConfidence : CONFIRMED (string)

baseScore : 4.4 (number)

temporalScore : 3.9 (number)

baseSeverity : MEDIUM (string)

temporalSeverity : LOW (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : text (string)

lang : en (string)

description : Obtain Information (string)

}

]

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T01:58:17.684Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.ibm.com/support/pages/node/6615285 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

name : ibm-cognos-cve202139009-info-disc (213554) (string)

tags : [ »

0 : vdb-entry (string)

1 : x_transferred (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/213554 (string)

}

2 : { »

url : https://security.netapp.com/advisory/ntap-20221014-0005/ (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "89AC2F63-02F5-449F-A66C-24AAFA34ED98", "versionEndExcluding": "11.1.7", "versionStartIncluding": "11.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "820F9237-E014-43DC-9AEB-9FA97FA52E5E", "versionEndExcluding": "11.2.3", "versionStartIncluding": "11.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.1.7:-:*:*:*:*:*:*", "matchCriteriaId": "6680448A-C3B3-4FEE-A500-974681D3E731", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack1:*:*:*:*:*:*", "matchCriteriaId": "A2E66D31-A2CC-4F06-89D3-9A881EADE0FD", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack2:*:*:*:*:*:*", "matchCriteriaId": "A76630E7-2DEB-4992-A671-85729B80E46B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack3:*:*:*:*:*:*", "matchCriteriaId": "38BDC609-EA7D-4C15-868A-EC8D8FFD3AF9", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack4:*:*:*:*:*:*", "matchCriteriaId": "BCF5213D-4BB1-4109-8B1B-5CA129819692", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 213554."}, {"lang": "es", "value": "IBM Cognos Analytics versiones 11.1.7, 11.2.0 y 11.2.1, almacena las credenciales de usuario en texto sin cifrar que puede ser le\u00eddo por un usuario local privilegiado. IBM X-Force ID: 213554"}], "id": "CVE-2021-39009", "lastModified": "2024-11-21T06:18:24.337", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 0.8, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-09-01T19:15:12.000", "references": [{"source": "psirt@us.ibm.com", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/213554"}, {"source": "psirt@us.ibm.com", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20221014-0005/"}, {"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/6615285"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/213554"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20221014-0005/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/6615285"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 89AC2F63-02F5-449F-A66C-24AAFA34ED98 (string)

versionEndExcluding : 11.1.7 (string)

versionStartIncluding : 11.1.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 820F9237-E014-43DC-9AEB-9FA97FA52E5E (string)

versionEndExcluding : 11.2.3 (string)

versionStartIncluding : 11.2.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:ibm:cognos_analytics:11.1.7:-:*:*:*:*:*:* (string)

matchCriteriaId : 6680448A-C3B3-4FEE-A500-974681D3E731 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack1:*:*:*:*:*:* (string)

matchCriteriaId : A2E66D31-A2CC-4F06-89D3-9A881EADE0FD (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack2:*:*:*:*:*:* (string)

matchCriteriaId : A76630E7-2DEB-4992-A671-85729B80E46B (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack3:*:*:*:*:*:* (string)

matchCriteriaId : 38BDC609-EA7D-4C15-868A-EC8D8FFD3AF9 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack4:*:*:*:*:*:* (string)

matchCriteriaId : BCF5213D-4BB1-4109-8B1B-5CA129819692 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F1BE6C1F-2565-4E97-92AA-16563E5660A5 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 213554. (string)

}

1 : { »

lang : es (string)

value : IBM Cognos Analytics versiones 11.1.7, 11.2.0 y 11.2.1, almacena las credenciales de usuario en texto sin cifrar que puede ser leído por un usuario local privilegiado. IBM X-Force ID: 213554 (string)

}

]

id : CVE-2021-39009 (string)

lastModified : 2024-11-21T06:18:24.337 (string)

metrics : { »

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 4.4 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 0.8 (number)

impactScore : 3.6 (number)

source : psirt@us.ibm.com (string)

type : Secondary (string)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 5.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2022-09-01T19:15:12.000 (string)

references : [ »

0 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : VDB Entry (string)

1 : Vendor Advisory (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/213554 (string)

}

1 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://security.netapp.com/advisory/ntap-20221014-0005/ (string)

}

2 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://www.ibm.com/support/pages/node/6615285 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : VDB Entry (string)

1 : Vendor Advisory (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/213554 (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://security.netapp.com/advisory/ntap-20221014-0005/ (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://www.ibm.com/support/pages/node/6615285 (string)

}

]

sourceIdentifier : psirt@us.ibm.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-312 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object