CVE-2020-4561 — CRITICAL (10.0)

Vulnerability Description

IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who can access a valid CA endpoint to read and write files to the Cognos Analytics system. IBM X-Force ID: 183903.

CVSS Score

10.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Ibm	Cognos Analytics	11.0.0
Netapp	Oncommand Insight	-

Related Weaknesses (CWE)

CWE-829

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/183903VDB EntryVendor Advisory
https://security.netapp.com/advisory/ntap-20210622-0004/Third Party Advisory
https://www.ibm.com/support/pages/node/6451705PatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/183903VDB EntryVendor Advisory
https://security.netapp.com/advisory/ntap-20210622-0004/Third Party Advisory
https://www.ibm.com/support/pages/node/6451705PatchVendor Advisory

FAQ

What is CVE-2020-4561?

CVE-2020-4561 is a vulnerability with a CVSS score of 10.0 (CRITICAL). IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who can access a valid CA endpoint to read and write fil...

How severe is CVE-2020-4561?

CVE-2020-4561 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-4561?

Check the references section above for vendor advisories and patch information. Affected products include: Ibm Cognos Analytics, Netapp Oncommand Insight.