Login Request a demo
Unscored severity · published Mar 2, 2013
CVE-2012-4837
IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote authenticated users to conduct XPath injection…
–
CVSS
1.1%
EPSS
No
On KEV
Description
IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote authenticated users to conduct XPath injection attacks, and read arbitrary XML files, via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CB
Cognos Business Intelligence · Ibm
8.4.1; 10.1; 10.1.1; 10.2 · source: NVD
Affected product
CB
Cognos Business Intelligence
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-4837
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-4837
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg21626697
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg24034373
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/78919
More from Cognos Business Intelligence
8.8
CVE-2018-1934
IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a…
8.8
CVE-2016-8960
IBM Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to adopt the Capabilities of a higher-privilege user by intercepting the…
7.5
CVE-2016-3036
IBM Cognos TM1 10.1 and 10.2 is vulnerable to a denial of service, caused by a stack-based buffer overflow when parsing packets
7.0
CVE-2017-1764
IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized circumstances, could expose plain text credentials to a local user
6.5
CVE-2016-0254
IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data