CVE-2021-29892: IBM Cognos Controller information disclosure

Reference Links

• https://www.ibm.com/support/pages/node/7177220 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-7177220

Frequently Asked Questions

• What is the severity of CVE-2021-29892?

  CVE-2021-29892 has a medium severity rating due to its potential to expose sensitive information via man-in-the-middle attacks.

• How do I fix CVE-2021-29892?

  To fix CVE-2021-29892, upgrade IBM Cognos Controller to version 11.1.0 or later where HTTP Strict Transport Security is properly implemented.

• What types of systems are affected by CVE-2021-29892?

  CVE-2021-29892 affects IBM Cognos Controller versions 11.0.0 and 11.0.1.

• What can happen if CVE-2021-29892 is exploited?

  If CVE-2021-29892 is exploited, an attacker could intercept and access sensitive information transmitted over HTTP.

• Is there a workaround for CVE-2021-29892 before upgrading?

  A temporary workaround for CVE-2021-29892 is to ensure that sensitive data is always accessed over HTTPS, mitigating the risk of man-in-the-middle attacks.