Insufficient Session Expiration in IBM Cognos Command Center 10.2.4.1 Enables Local Info Disclosure
CVE-2022-38707 Published on May 5, 2023

IBM Cognos Command Center information disclosure
IBM Cognos Command Center 10.2.4.1 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 234179.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2022-38707 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.

Exploitation:
NONE
Automatable:
NO
Technical Impact:
PARTIAL
Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."


Products Associated with CVE-2022-38707

Want to know whenever a new CVE is published for IBM Cognos Command Center? stack.watch will email you.

IBM Cognos Command Center

Affected Versions

IBM Cognos Command Center Version 10.2.4.1 is affected by CVE-2022-38707

Exploit Probability

EPSS
0.17%
Percentile
5.85%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.