CVE-2022-22364

IBM Cognos Controller security bypass

Severity Score

5.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with. IBM X-Force ID: 220903.

IBM Cognos Controller 10.4.1, 10.4.2 y 11.0.0 es vulnerable a ataques de interacción de servicios externos, causados por una validación inadecuada de la entrada proporcionada por el usuario. Un atacante remoto podría aprovechar esta vulnerabilidad para inducir a la aplicación a realizar búsquedas de DNS en el lado del servidor o solicitudes HTTP a nombres de dominio arbitrarios. Al enviar cargas útiles adecuadas, un atacante puede hacer que el servidor de aplicaciones ataque otros sistemas con los que puede interactuar. ID de IBM X-Force: 220903.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2022-01-03 CVE Reserved
2024-05-03 CVE Published
2024-08-03 CVE Updated
2025-01-08 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action

CAPEC

References (2)

URL	Tag	Source
https://exchange.xforce.ibmcloud.com/vulnerabilities/220903	Vdb Entry

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.ibm.com/support/pages/node/7149876	2024-05-06

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Ibm Search vendor "Ibm"		Cognos Controller Search vendor "Ibm" for product "Cognos Controller"				*		-		Affected