Information disclosure in Cognos Analytics Mobile Server - CVE-2022-43383

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU99863

Information disclosure in Cognos Analytics Mobile Server - CVE-2022-43383

Published: November 6, 2024


Vulnerability identifier: #VU99863
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-43383
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to application uses Cross-Origin Resource Sharing (CORS). A local user can carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.


Affected software

Cognos Analytics Mobile Server
Cognos Analytics Mobile (Android)
Cognos Analytics Mobile (iOS)

How to mitigate CVE-2022-43383

Install updates from vendor's website.

Cognos Analytics Mobile Server - update to 1.1.20
Cognos Analytics Mobile (Android) - update to 1.1.20
Cognos Analytics Mobile (iOS) - update to 1.1.20

External References

Related Security Bulletins