IBM Cognos Business Intelligence CVE-2014-6145 Unspecified Cross Site Scripting Vulnerability
BID:74321
Info
IBM Cognos Business Intelligence CVE-2014-6145 Unspecified Cross Site Scripting Vulnerability
| Bugtraq ID: | 74321 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-6145 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 19 2014 12:00AM |
| Updated: | Dec 19 2014 12:00AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
IBM Tivoli Common Reporting 2.1.1 IBM Tivoli Common Reporting 3.1.0.2 IBM Tivoli Common Reporting 3.1.0.1 IBM Tivoli Common Reporting 3.1 IBM Tivoli Common Reporting 2.1.1.2 IBM Tivoli Common Reporting 2.1 IBM Cognos Business Intelligence 10.2.1 IBM Cognos Business Intelligence 10.1.1 IBM Cognos Business Intelligence 10.2.2 IBM Cognos Business Intelligence 10.2.1.1 IBM Cognos Business Intelligence 10.2 IBM Cognos Business Intelligence 10.1 |
| Not Vulnerable: | |
Discussion
IBM Cognos Business Intelligence CVE-2014-6145 Unspecified Cross Site Scripting Vulnerability
IBM Cognos Business Intelligence is prone to an unspecified cross-site scripting vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
IBM Cognos Business Intelligence 10.2.2, 10.2.1.1, 10.2.1, 10.2, 10.1.1, and 10.1 are vulnerable.
IBM Cognos Business Intelligence is prone to an unspecified cross-site scripting vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
IBM Cognos Business Intelligence 10.2.2, 10.2.1.1, 10.2.1, 10.2, 10.1.1, and 10.1 are vulnerable.
Exploit / POC
IBM Cognos Business Intelligence CVE-2014-6145 Unspecified Cross Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting user into visiting a specially crafted URL.
An attacker can exploit this issue by enticing an unsuspecting user into visiting a specially crafted URL.
Solution / Fix
IBM Cognos Business Intelligence CVE-2014-6145 Unspecified Cross Site Scripting Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
IBM Cognos Business Intelligence CVE-2014-6145 Unspecified Cross Site Scripting Vulnerability
References:
References:
- IBM Homepage (IBM)
- Cognos Business Intelligence 10.1.x interim fixes address a security vulnerabili (IBM)
- Cognos Business Intelligence 10.2.2 Interim Fix 1 addresses a Security Vulnerabi (IBM)
- Cognos Business Intelligence 10.2.x interim fixes address a security vulnerabili (IBM)
- IBM Cognos Business Intelligence Server is affected by multiple vulnerabilities (IBM)
- Tivoli Common Reporting iFixes for CVE-2014-3566,CVE-2014-6145,CVE-2014-1568,CVE (IBM)