CVE-2024-52902
Summary
IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could be used for unauthorized access to the system.
Severity
- Base Score: 8.8
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Exploitability Score: 2.8
- Impact Score: 5.9
- Exploitable: Yes
Details
The IBM Cognos Controller client application, versions 11.0.0 through 11.0.1 FP3 and 11.1.0, is vulnerable to a security flaw. Hard-coded database passwords are present in the application’s source code. This vulnerability could be exploited by a local attacker with access to the client application’s files to gain unauthorized access to the database, potentially leading to the compromise of sensitive data and/or the entire system.
Remediation
To remediate this vulnerability, IBM recommends upgrading to a fixed version of Cognos Controller that addresses this issue. Specific fixed versions are not available for public, look into IBM’s official security bulletin for specific patch requirements.
Steps to take:
- Identify Affected Systems: Determine all systems running the vulnerable versions of IBM Cognos Controller (11.0.0 through 11.0.1 FP3 and 11.1.0).
- Apply the Fix: Contact IBM support to obtain and apply the appropriate fix or patch for your specific version of Cognos Controller. Apply this patch in a test environment first.
- Change Database Passwords: Once the patch is applied, immediately change all database passwords associated with Cognos Controller to strong, unique passwords.
- Review Access Controls: Review and strengthen access control policies for the database and the Cognos Controller application to limit unauthorized access.
- Monitor for Suspicious Activity: Implement monitoring mechanisms to detect any suspicious activity or unauthorized access attempts.
- Regularly Update: Stay informed about security updates and patches released by IBM and apply them promptly to mitigate future vulnerabilities.
- Secure Development Practices: Follow secure development practices to prevent similar vulnerabilities from being introduced in future releases.
Assigner
- Name: IBM Corporation
- Email: [email protected]
Date
- Published Date: 2024-02-19 15:15:15
- Updated Date: 2024-02-19 15:15:15