Vulnerability in IBM Cognos Mobile

CVE-2014-4810

IBM Cognos Mobile 10.1.1 before FP3 IF1, 10.2.0 before FP2 IF1, and 10.2.1 before FP4 IF1 preserves a session between the Cognos Mobile server and the Cognos Business Intelligence server after a logoff action on a mobile device, which makes it easier for remote attackers to bypass intended Business Intelligence restrictions by leveraging access to authentication data that was captured before this logoff.

EPSS: 0.011 (63.4th percentile) — read the EPSS interpretation.

Affected products

Ibm Cognos_mobile — versions 10.1.1, 10.2.0, 10.2.1
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

psirt@us.ibm.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
psirt@us.ibm.com (vdb-entry, x_refsource_XF)