CVE-2022-39163: IBM Cognos Controller HTTP response smuggling
IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connection that could lead to further cross-site scripting (XSS) attacks.
Other sources
IBM Cognos Controller is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connection that could lead to further cross-site scripting (XSS) attacks.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-39163?
CVE-2022-39163 has a medium severity rating due to its potential for exploitation through client-side attacks.
How do I fix CVE-2022-39163?
To mitigate CVE-2022-39163, upgrade IBM Cognos Controller to version 11.1.1 or later.
What types of attacks can be conducted using CVE-2022-39163?
CVE-2022-39163 can lead to cross-site scripting (XSS) attacks due to the vulnerability in client-side desynchronization.
Which versions of IBM Cognos Controller are affected by CVE-2022-39163?
The affected versions include IBM Cognos Controller 11.0.0 through 11.1.0.
Is CVE-2022-39163 a client-side vulnerability?
Yes, CVE-2022-39163 is classified as a client-side vulnerability due to the exploitation method involving browser connections.