CVE-2021-20450: IBM Cognos Controller information disclosure
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 196640.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-20450?
CVE-2021-20450 is considered a medium severity vulnerability due to the potential for session hijacking.
How do I fix CVE-2021-20450?
To fix CVE-2021-20450, ensure that the secure attribute is set on authorization tokens and session cookies in IBM Cognos Controller.
Which versions of IBM Cognos Controller are affected by CVE-2021-20450?
CVE-2021-20450 affects IBM Cognos Controller versions 10.4.1, 10.4.2, and 11.0.0.
What potential impact does CVE-2021-20450 have?
CVE-2021-20450 allows attackers to potentially steal session cookies, which may lead to unauthorized access.
Is user interaction required to exploit CVE-2021-20450?
Yes, exploitation of CVE-2021-20450 typically requires user interaction to click on a malicious link.