CVE-2019-4171

LOW

IBM Cognos Controller - Missing Encryption

Title source: rule

Description

IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 158876.

References (2)

[Patch, Vendor Advisory] https://www.ibm.com/support/pages/security-bulletin-security-vulnerabilties-exist-ibm-cognos-controller

[VDB Entry, Vendor Advisory] https://exchange.xforce.ibmcloud.com/vulnerabilities/158876

Scores

CVSS v3 3.7

EPSS 0.0018

EPSS Percentile 39.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-311

Status published

Products (4)

ibm/cognos_controller 10.3.0

ibm/cognos_controller 10.3.1

ibm/cognos_controller 10.4.0

ibm/cognos_controller 10.4.1

Published Sep 17, 2019

Tracked Since Feb 18, 2026