description: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 233571.
problem types: Obtain Information
affected:
{
vendor: IBM
product: Cognos Analytics
versions:
version: 11.2.0, status: affected
version: 11.1.7, status: affected
version: 11.2.1, status: affected
}
metrics:
cvssV3_0: [
version: 3.0
vectorString: CVSS:3.0/AC:L/I:N/AV:N/C:H/A:L/UI:N/S:U/PR:L/RC:C/RL:O/E:U
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: LOW
exploitCodeMaturity: UNPROVEN
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
baseScore: 7.1
temporalScore: 6.2
baseSeverity: HIGH
temporalSeverity: MEDIUM
]