Login Request a demo
Unscored severity · published Mar 2, 2013
CVE-2012-4858
IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 does not properly validate Java serialized input, which allows…
–
CVSS
3.9%
EPSS
No
On KEV
Description
IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 does not properly validate Java serialized input, which allows remote attackers to execute arbitrary commands via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CB
Cognos Business Intelligence · Ibm
8.4.1; 10.1; 10.1.1; 10.2 · source: NVD
Affected product
CB
Cognos Business Intelligence
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-4858
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-4858
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg21626697
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg24034373
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/79801
More from Cognos Business Intelligence
8.8
CVE-2018-1934
IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a…
8.8
CVE-2016-8960
IBM Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to adopt the Capabilities of a higher-privilege user by intercepting the…
7.5
CVE-2016-3036
IBM Cognos TM1 10.1 and 10.2 is vulnerable to a denial of service, caused by a stack-based buffer overflow when parsing packets
7.0
CVE-2017-1764
IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized circumstances, could expose plain text credentials to a local user
6.5
CVE-2016-0254
IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data