CVE-2019-4171

LOW

IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1 - Missing Encryption of Sensitive Data in Session Cookies

Title source: llm

Description

IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 158876.

References (2)

Core 2

Core References

Patch, Vendor Advisory x_refsource_confirm

https://www.ibm.com/support/pages/security-bulletin-security-vulnerabilties-exist-ibm-cognos-controller

VDB Entry, Vendor Advisory vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/158876

Scores

CVSS v3 3.7

EPSS 0.0064

EPSS Percentile 45.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-311

Status published

Products (4)

ibm/cognos_controller 10.3.0

ibm/cognos_controller 10.3.1

ibm/cognos_controller 10.4.0

ibm/cognos_controller 10.4.1

Published Sep 17, 2019

Tracked Since Feb 18, 2026