CVE-2020-4561
moderate-risk
Published 2021-06-01
IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who can access a valid CA endpoint to read and write files to the Cognos Analytics system. IBM X-Force ID: 183903.
Do I need to act?
-
0.87% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
10
CVSS 10.0/10
Critical
NETWORK
/ LOW complexity
Affected Products (3)
References (6)
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210622-0004/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210622-0004/
45
/ 100
moderate-risk
Severity
33/34 · Critical
Exploitability
3/34 · Minimal
Exposure
9/34 · Low