CVE-2015-7436

LOW

IBM Tivoli Common Reporting <3.1.2.1 - Privilege Escalation

Title source: llm
STIX 2.1

Description

IBM Tivoli Common Reporting (TCR) 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0 through 3.1.2 as used in Cognos Business Intelligence before 10.2 IF16, and 3.1.2.1 as used in Cognos Business Intelligence before 10.2.1.1 IF12 preserves user permissions across group-add and group-remove operations, which allows local users to bypass intended access restrictions in opportunistic circumstances by leveraging administrative changes to group membership.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21972799

Scores

CVSS v3 2.5
EPSS 0.0028
EPSS Percentile 20.3%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-264
Status published
Products (8)
ibm/tivoli_common_reporting 2.1
ibm/tivoli_common_reporting 2.1.1
ibm/tivoli_common_reporting 2.1.1.2
ibm/tivoli_common_reporting 3.1
ibm/tivoli_common_reporting 3.1.0.1
ibm/tivoli_common_reporting 3.1.0.2
ibm/tivoli_common_reporting 3.1.2
ibm/tivoli_common_reporting 3.1.2.1
Published Jan 02, 2016
Tracked Since Feb 18, 2026