CVE-2023-40695: IBM Cognos Controller session fixation
Published May 3, 2024
·Updated
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 264938.
Affected Software
3 affected components
IBM Cognos Controller=10.4.1
IBM Cognos Controller=10.4.2
IBM Cognos Controller=11.0.0
Event History
May 3, 2024
CVE Published
via MITRE·06:18 PM
Data Sourced
via MITRE·06:18 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-40695?
CVE-2023-40695 has a medium severity rating due to its impact on session management.
2
How do I fix CVE-2023-40695?
To fix CVE-2023-40695, ensure that you upgrade to a patched version of IBM Cognos Controller where session invalidation is properly implemented.
3
What are the affected versions of CVE-2023-40695?
CVE-2023-40695 affects IBM Cognos Controller versions 10.4.1, 10.4.2, and 11.0.0.
4
What is the impact of CVE-2023-40695?
The impact of CVE-2023-40695 is that it allows an authenticated user to potentially impersonate another user due to session management flaws.
5
Is CVE-2023-40695 a client-side or server-side vulnerability?
CVE-2023-40695 is primarily a server-side vulnerability affecting session handling after user logout.