CVE-2023-30996 : IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 could be vulnerable to informati

IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 could be vulnerable to information leakage due to unverified sources in messages sent between Windows objects of different origins. IBM X-Force ID: 254290.

Published 2024-02-26 16:27:46

Updated 2024-12-17 19:32:36

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2023-30996

IBM » Cognos Analytics
Versions from including (>=) 11.1.1 and before (<) 11.1.7
cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*
Matching versions
IBM » Cognos Analytics
Versions from including (>=) 11.2.0 and before (<) 11.2.4
cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*
Matching versions
IBM » Cognos Analytics » Version: 11.1.7
cpe:2.3:a:ibm:cognos_analytics:11.1.7:-:*:*:*:*:*:*
Matching versions
IBM » Cognos Analytics » Version: 11.1.7 Update Fixpack1
cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack1:*:*:*:*:*:*
Matching versions
IBM » Cognos Analytics » Version: 11.1.7 Update Fixpack2
cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack2:*:*:*:*:*:*
Matching versions
IBM » Cognos Analytics » Version: 11.1.7 Update Fixpack3
cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack3:*:*:*:*:*:*
Matching versions
IBM » Cognos Analytics » Version: 11.1.7 Update Fixpack4
cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack4:*:*:*:*:*:*
Matching versions
IBM » Cognos Analytics » Version: 11.1.7 Update Fixpack5
cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack5:*:*:*:*:*:*
Matching versions
IBM » Cognos Analytics » Version: 11.1.7 Update Fixpack6
cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack6:*:*:*:*:*:*
Matching versions
IBM » Cognos Analytics » Version: 11.2.4
cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*
Matching versions
IBM » Cognos Analytics » Version: 11.2.4 Update Fixpack1
cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack1:*:*:*:*:*:*
Matching versions
IBM » Cognos Analytics » Version: 11.1.7 Update Fixpack7
cpe:2.3:a:ibm:cognos_analytics:11.1.7:fixpack7:*:*:*:*:*:*
Matching versions
IBM » Cognos Analytics » Version: 12.0.0
cpe:2.3:a:ibm:cognos_analytics:12.0.0:*:*:*:*:*:*:*
Matching versions
IBM » Cognos Analytics » Version: 12.0.1
cpe:2.3:a:ibm:cognos_analytics:12.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Cognos Analytics » Version: 11.2.4 Update Fixpack2
cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack2:*:*:*:*:*:*
Matching versions
Netapp » Oncommand Insight » Version: N/A
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-30996

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 12 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-30996

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST	2024-12-17
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	IBM Corporation	2024-02-26
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2023-30996

CWE-346 Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

Assigned by: psirt@us.ibm.com (Secondary)

References for CVE-2023-30996

https://exchange.xforce.ibmcloud.com/vulnerabilities/254290

IBM Cognos Analytics cross-origin resource sharing CVE-2023-30996 Vulnerability Report
VDB Entry;Vendor Advisory
https://security.netapp.com/advisory/ntap-20240405-0004/

CVE-2023-30996 IBM Cognos Analytics Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0006/

February 2024 IBM Cognos Analytics Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://www.ibm.com/support/pages/node/7123154

Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2023-30996

Products affected by CVE-2023-30996

Exploit prediction scoring system (EPSS) score for CVE-2023-30996

CVSS scores for CVE-2023-30996

CWE ids for CVE-2023-30996

References for CVE-2023-30996