description: A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the application is installed, can escalate their privilege from Low level to Super Admin and gain access to Create/Update/Delete any level of user in Cognos Controller. IBM X-Force ID: 186625.
problem types: Gain Privileges
affected:
{
product: Cognos Controller
vendor: IBM
versions:
status: affected, version: 10.3.1
status: affected, version: 10.3.0
status: affected, version: 10.4.0
status: affected, version: 10.4.1
status: affected, version: 10.4.2
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: UNPROVEN
integrityImpact: HIGH
privilegesRequired: HIGH
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: CHANGED
temporalScore: 7
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.0/S:C/I:H/C:H/AC:H/A:H/PR:H/UI:N/AV:N/RL:O/RC:C/E:U
version: 3.0
]