CVE-2023-38724 - OpenCVE

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 262183.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ibm	Cognos Controller

No data.

No data.

References

Link	Providers
https://exchange.xforce.ibmcloud.com/vulnerabilities/262183
https://www.ibm.com/support/pages/node/7149876

History

No history.

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2024-05-03T17:36:13.659Z

Updated: 2024-08-02T17:46:56.692Z

Reserved: 2023-07-25T00:01:06.100Z

Link: CVE-2023-38724

Vulnrichment

Updated: 2024-05-15T16:09:57.718Z

NVD

Status : Awaiting Analysis

Published: 2024-05-03T18:15:08.860

Modified: 2024-05-06T12:44:56.377

Link: CVE-2023-38724

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-38724", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2023-07-25T00:01:06.100Z", "datePublished": "2024-05-03T17:36:13.659Z", "dateUpdated": "2024-08-02T17:46:56.692Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Cognos Controller", "vendor": "IBM", "versions": [{"status": "affected", "version": "10.4.1, 10.4.2, 11.0.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 262183."}], "value": "IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 262183."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2024-05-03T17:36:13.659Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/7149876"}, {"tags": ["vdb-entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/262183"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Cognos Controller SQL injection", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-38724", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-15T16:08:25.260891Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:ibm:cognos_controller:10.4.1:*:*:*:*:*:*:*"], "vendor": "ibm", "product": "cognos_controller", "versions": [{"status": "affected", "version": "10.4.1"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:ibm:cognos_controller:10.4.2:*:*:*:*:*:*:*"], "vendor": "ibm", "product": "cognos_controller", "versions": [{"status": "affected", "version": "10.4.2"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*"], "vendor": "ibm", "product": "cognos_controller", "versions": [{"status": "affected", "version": "11.0.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:28:08.894Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:46:56.692Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://www.ibm.com/support/pages/node/7149876"}, {"tags": ["vdb-entry", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/262183"}]}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-38724", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2023-07-25T00:01:06.100Z", "datePublished": "2024-05-03T17:36:13.659Z", "dateUpdated": "2024-06-04T17:28:08.894Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Cognos Controller", "vendor": "IBM", "versions": [{"status": "affected", "version": "10.4.1, 10.4.2, 11.0.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 262183."}], "value": "IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 262183."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2024-05-03T17:36:13.659Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/7149876"}, {"tags": ["vdb-entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/262183"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Cognos Controller SQL injection", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-38724", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-15T16:08:25.260891Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:ibm:cognos_controller:10.4.1:*:*:*:*:*:*:*"], "vendor": "ibm", "product": "cognos_controller", "versions": [{"status": "affected", "version": "10.4.1"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:ibm:cognos_controller:10.4.2:*:*:*:*:*:*:*"], "vendor": "ibm", "product": "cognos_controller", "versions": [{"status": "affected", "version": "10.4.2"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*"], "vendor": "ibm", "product": "cognos_controller", "versions": [{"status": "affected", "version": "11.0.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-15T16:09:57.718Z"}, "title": "CISA ADP Vulnrichment"}]}}