IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that could be interpreted a a server-side include (SSI) directive. IBM X-Force ID: 199915.
References
| Link | Resource |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/199915 | VDB Entry Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20211112-0005/ | Third Party Advisory |
| https://www.ibm.com/support/pages/node/6491661 | Patch Vendor Advisory |
Configurations
History
17 Nov 2021, 02:42
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | |
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20211112-0005/ - Third Party Advisory |
12 Nov 2021, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Oct 2021, 12:24
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 6.5
v3 : 8.8 |
| CWE | CWE-94 | |
| CPE | cpe:2.3:a:ibm:cognos_analytics:11.1.7:*:*:*:*:*:*:* cpe:2.3:a:ibm:cognos_analytics:11.2.0:*:*:*:*:*:*:* |
|
| References | (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/199915 - VDB Entry, Vendor Advisory | |
| References | (CONFIRM) https://www.ibm.com/support/pages/node/6491661 - Patch, Vendor Advisory |
15 Oct 2021, 16:27
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-10-15 16:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-29679
Mitre link : CVE-2021-29679
CVE.ORG link : CVE-2021-29679
JSON object : View
Products Affected
ibm
- cognos_analytics
netapp
- oncommand_insight
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')