CVE-2021-38904: Medium severity IBM Cognos Analytics vulnerability

Published Apr 22, 2022

Updated

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings. IBM X-Force ID: 209693.

Other sources

IBM Cognos Analytics could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings.

Affected Software

4 affected components

IBM Cognos Analytics=11.1.7

IBM Cognos Analytics=11.2.0

IBM Cognos Analytics=11.2.1

NetApp OnCommand Insight

Remediation

Patch Available

https://www.ibm.com/support/pages/node/6570957

Event History

Apr 22, 2022

CVE Published

via MITRE·04:30 PM

Data Sourced

via MITRE·04:30 PM

DescriptionSeverityWeakness

Aug 3, 2024

Data Sourced

via IBM·05:47 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-6570957

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2021-38904.

What is the title of this vulnerability?

The title of this vulnerability is 'IBM Cognos Analytics could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings.'

What is the severity level of CVE-2021-38904?

CVE-2021-38904 has a severity level of medium.

Which versions of IBM Cognos Analytics are affected by CVE-2021-38904?

IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.1.7 are affected by CVE-2021-38904.

How can a remote attacker obtain credentials from a user's browser?

A remote attacker can obtain credentials from a user's browser by exploiting incorrect autocomplete settings in IBM Cognos Analytics.