CVE-2021-29892: IBM Cognos Controller information disclosure
IBM Cognos Controller 11.0.0 and 11.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
Other sources
IBM Cognos Controller could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29892?
CVE-2021-29892 has a medium severity rating due to its potential to expose sensitive information via man-in-the-middle attacks.
How do I fix CVE-2021-29892?
To fix CVE-2021-29892, upgrade IBM Cognos Controller to version 11.1.0 or later where HTTP Strict Transport Security is properly implemented.
What types of systems are affected by CVE-2021-29892?
CVE-2021-29892 affects IBM Cognos Controller versions 11.0.0 and 11.0.1.
What can happen if CVE-2021-29892 is exploited?
If CVE-2021-29892 is exploited, an attacker could intercept and access sensitive information transmitted over HTTP.
Is there a workaround for CVE-2021-29892 before upgrading?
A temporary workaround for CVE-2021-29892 is to ensure that sensitive data is always accessed over HTTPS, mitigating the risk of man-in-the-middle attacks.