IBM Cognos Analytics Multiple Vulnerabilities (6616285)

critical Nessus Plugin ID 164652

Language:

Synopsis

The remote web application is affected by multiple vulnerabilities.

Description

The version of IBM Cognos Analytics installed on the remote host is affected by multiple vulnerabilities, including the following:

- The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation). (CVE-2022-29078)

- The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.
(CVE-2021-29418)

- Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts. (CVE-2021-28918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to IBM Cognos Analytics 11.1.7 FP5, 11.2.3, or later.

Plugin Details

Severity: Critical

ID: 164652

File Name: ibm_cognos_6615285.nasl

Version: 1.4

Type: remote

Family: CGI abuses

Published: 9/2/2022

Updated: 10/13/2023

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2022-29078

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ibm:cognos_analytics

Required KB Items: installed_sw/IBM Cognos Analytics

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/31/2022

Vulnerability Publication Date: 8/31/2022

Reference Information

CVE: CVE-2020-28469, CVE-2020-36518, CVE-2020-4301, CVE-2021-20468, CVE-2021-23438, CVE-2021-28918, CVE-2021-29418, CVE-2021-29823, CVE-2021-3749, CVE-2021-3807, CVE-2021-39009, CVE-2021-39045, CVE-2021-43797, CVE-2021-44531, CVE-2021-44532, CVE-2021-44533, CVE-2022-21803, CVE-2022-21824, CVE-2022-29078, CVE-2022-30614, CVE-2022-36773

IAVB: 2022-B-0031-S

Detections

Analytics