Improper Certificate Validation in Cognos Analytics Mobile Server - CVE-2023-38009

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU99864

Improper Certificate Validation in Cognos Analytics Mobile Server - CVE-2023-38009

Published: November 6, 2024


Vulnerability identifier: #VU99864
CSH Severity: Low
CVSS v4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-38009
CWE-ID: CWE-295
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows an attacker with physical access to gain access to potentially sensitive information.

The vulnerability exists due to a lack of certificate pinning. An attacker with physical can gain unauthorized access to sensitive information on the system.


Affected software

Cognos Analytics Mobile Server
Cognos Analytics Mobile (Android)
Cognos Analytics Mobile (iOS)

How to mitigate CVE-2023-38009

Install updates from vendor's website.

Cognos Analytics Mobile Server - update to 1.1.20
Cognos Analytics Mobile (Android) - update to 1.1.20
Cognos Analytics Mobile (iOS) - update to 1.1.20

External References

Related Security Bulletins