Login Request a demo
Low severity · published Jan 2, 2016
CVE-2015-7435
IBM Tivoli Common Reporting (TCR) 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0 through 3.1.2 as used in Cognos Business Intelligence before 10.2 IF16, and…
2.5
CVSS
0.3%
EPSS
No
On KEV
Description
IBM Tivoli Common Reporting (TCR) 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0 through 3.1.2 as used in Cognos Business Intelligence before 10.2 IF16, and 3.1.2.1 as used in Cognos Business Intelligence before 10.2.1.1 IF12 allows local users to bypass the Cognos Application Firewall (CAF) protection mechanism via leading whitespace in the BackURL field.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
Tivoli Common Reporting · Ibm
2.1; 2.1.1; 2.1.1.2; 3.1; 3.1.0.1; 3.1.0.2; +2 more · source: NVD
Affected product
TC
Tivoli Common Reporting
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7435
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7435
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21972799
More from Tivoli Common Reporting
9.8
CVE-2015-7450
IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
2.5
CVE-2015-7436
IBM Tivoli Common Reporting (TCR) 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0 through 3.1.2 as used in Cognos Business Intelligence before 10.2 IF16, and…
–
CVE-2015-1969
Cross-site scripting (XSS) vulnerability in IBM Tivoli Common Reporting (TCR) 2.1 before IF13 and 2.1.1 before IF21, and TCR 3.1.x as used in Cognos Business Intelligence before…
–
CVE-2011-0732
Multiple unspecified vulnerabilities in IBM Tivoli Integrated Portal (TIP) 1.1.1.1, as used in IBM Tivoli Common Reporting (TCR) 1.2.0 before Interim Fix 9, have unknown impact…