IBM Cognos Controller improper certificate validation (IBM Controller)

CVE-2024-40702

HIGH 8.2

En bref

Source: NVD
EPSS: EPSS 0.26 % · centile 18 (2026-10-31)
État: PUBLISHED
Publiée: 2025-01-07 16:02 UTC
Mise à jour: 2025-01-07 16:59 UTC
Attribuée par: ibm
Statut NVD: Analyzed

Rechercher sur…

Description

IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow an unauthorized user to obtain valid tokens to gain access to protected resources due to improper certificate validation.

Faiblesses (CWE)

CWE-295 — Validation incorrecte de certificat

Références

https://www.ibm.com/support/pages/node/7179163

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N	ibm
CVSS 3.1	HIGH 8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N	NVD · psirt@us.ibm.com (Secondary)

Références européennes

ENISA EUVD · EUVD-2024-38813
GCVE · GCVE-0-2024-40702

Configurations affectées (CPE NVD)

cpe:2.3:a:ibm:cognos_controller:*:*:*:*:*:*:*:* ≥ 11.0.0 ≤ 11.0.1
cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
IBM · Controller	affected 11.1.0
IBM · Cognos Controller	affected 11.0.0 ≤ 11.0.1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD