CVE-2023-50324

IBM Cognos Command Center information disclosure

Severity Score

5.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

IBM Cognos Command Center 10.2.4.1 and 10.2.5 exposes details the X-AspNet-Version Response Header that could allow an attacker to obtain information of the application environment to conduct further attacks. IBM X-Force ID: 275038.

IBM Cognos Command Center 10.2.4.1 y 10.2.5 expone detalles del encabezado de respuesta X-AspNet-Version que podría permitir a un atacante obtener información del entorno de la aplicación para realizar más ataques. ID de IBM X-Force: 275038.

*Credits: N/A

CVSS Scores

IBM Corporationv3.1 5.3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-12-07 CVE Reserved
2024-03-01 CVE Published
2024-03-01 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CAPEC

References (2)

URL	Tag	Source
https://exchange.xforce.ibmcloud.com/vulnerabilities/275038	Vdb Entry

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.ibm.com/support/pages/node/7112504	2024-03-01

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
-		-				-		-		-