CVE-2024-31899 - Vulnerability Details - OpenCVE

IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device.

No CVSS v4.0

Attack Vector Physical

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00038.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ibm	Cognos Command Center

Configuration 1 [-]

OR	cpe:2.3:a:ibm:cognos_command_center:10.2.4.1:::::::*
	cpe:2.3:a:ibm:cognos_command_center:10.2.5:::::::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-29757	IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.ibm.com/support/pages/node/7149734

History

Tue, 07 Jan 2025 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-522

Thu, 26 Sep 2024 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 26 Sep 2024 13:45:00 +0000

Type	Values Removed	Values Added
Description		IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device.
Title		IBM Cognos Command Center information disclosure
First Time appeared		Ibm Ibm cognos Command Center
Weaknesses		CWE-256
CPEs		cpe:2.3:a:ibm:cognos_command_center:10.2.4.1:::::::* cpe:2.3:a:ibm:cognos_command_center:10.2.5:::::::*
Vendors & Products		Ibm Ibm cognos Command Center
References		https://www.ibm.com/support/pages/node/7149734
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2024-09-26T13:34:57.008Z

Updated: 2024-09-26T17:04:12.761Z

Reserved: 2024-04-07T12:44:57.197Z

Link: CVE-2024-31899

Vulnrichment

Updated: 2024-09-26T17:03:24.552Z

NVD

Status : Analyzed

Published: 2024-09-26T14:15:08.433

Modified: 2025-01-07T20:02:40.877

Link: CVE-2024-31899

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31899", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2024-04-07T12:44:57.197Z", "datePublished": "2024-09-26T13:34:57.008Z", "dateUpdated": "2024-09-26T17:04:12.761Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:cognos_command_center:10.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:cognos_command_center:10.2.4.1:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Cognos Command Center", "vendor": "IBM", "versions": [{"status": "affected", "version": "10.2.4.1, 10.2.5"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device."}], "value": "IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-256", "description": "CWE-256 Plaintext Storage of a Password", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2024-09-26T13:34:57.008Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/7149734"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Cognos Command Center information disclosure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-26T17:03:17.985272Z", "id": "CVE-2024-31899", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-26T17:04:12.761Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-31899", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-26T17:03:17.985272Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-26T17:03:24.552Z"}}], "cna": {"title": "IBM Cognos Command Center information disclosure", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:cognos_command_center:10.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:cognos_command_center:10.2.4.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Cognos Command Center", "versions": [{"status": "affected", "version": "10.2.4.1, 10.2.5"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.ibm.com/support/pages/node/7149734", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device.", "supportingMedia": [{"type": "text/html", "value": "IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-256", "description": "CWE-256 Plaintext Storage of a Password"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2024-09-26T13:34:57.008Z"}}}, "cveMetadata": {"cveId": "CVE-2024-31899", "state": "PUBLISHED", "dateUpdated": "2024-09-26T17:04:12.761Z", "dateReserved": "2024-04-07T12:44:57.197Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2024-09-26T13:34:57.008Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:cognos_command_center:10.2.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "9BA2D482-F396-4704-ACBA-E81720686DDB", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cognos_command_center:10.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "E1F58E67-8E8F-4DA0-B9C0-68683BDAB5A8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device."}, {"lang": "es", "value": "IBM Cognos Command Center 10.2.4.1 y 10.2.5 podr\u00edan revelar informaci\u00f3n de usuario altamente confidencial a un usuario autenticado con acceso f\u00edsico al dispositivo."}], "id": "CVE-2024-31899", "lastModified": "2025-01-07T20:02:40.877", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-09-26T14:15:08.433", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7149734"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-256"}], "source": "psirt@us.ibm.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}