CVE-2023-28952
EUVD-2023-3257003.05.2024, 18:15
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to injection attacks in application logging by not sanitizing user provided data. IBM X-Force ID: 251463.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| ibm | cognos_controller | 10.4.1 |
| ibm | cognos_controller | 10.4.2 |
| ibm | cognos_controller | 11.0.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-117 - Improper Output Neutralization for LogsThe software does not neutralize or incorrectly neutralizes output that is written to logs.
- CWE-116 - Improper Encoding or Escaping of OutputThe software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.