← Vulnerability feed

Vulnerability record · CVE-2023-38724 · published 3 May 2024

CVE-2023-38724: Ibm cognos controller sql injection vulnerability

Ibm · Cognos Controller

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 262183.

9.8 CVSS 3.1 Critical EPSS 0.46% · top 62.2% CWE-89 · SQL injection
9.8CVSS 3.1 base score
0.46%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 262183.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://exchange.xforce.ibmcloud.com/vulnerabilities/262183 Vendor Advisory
https://www.ibm.com/support/pages/node/7149876 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/262183 Vendor Advisory
https://www.ibm.com/support/pages/node/7149876 Vendor Advisory

Track CVE-2023-38724 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-25020Ibm cognos controller unrestricted file upload vulnerabilityIBM Cognos Controller 11.0.0 and 11.0.1 is vulnerable to malicious file upload by allowing unrestricted filetype attachments in the Journal entry pag…EPSS 0.28%9.8CVE-2024-40691Ibm cognos controller unrestricted file upload vulnerabilityIBM Cognos Controller 11.0.0 and 11.0.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web in…EPSS 0.37%9.8CVE-2024-25019Ibm cognos controller unrestricted file upload vulnerabilityIBM Cognos Controller 11.0.0 and 11.0.1 could be vulnerable to malicious file upload by not validating the type of file uploaded to Journal entry att…EPSS 0.28%9.8CVE-2020-4877Ibm cognos controller incorrect authorization vulnerabilityIBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could be vulnerable to unauthorized modifications by using public fields in public classes. IBM X-Fo…EPSS 0.90%9.8CVE-2020-4879Ibm cognos controller improper authentication vulnerabilityIBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of auth…EPSS 1.5%8.8CVE-2024-28777Ibm cognos controller deserialization of untrusted data vulnerabilityIBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to unrestricted deserialization. This vulnerability allows us…EPSS 0.61%8.8CVE-2024-52902Ibm cognos controller hard-coded credentials vulnerabilityIBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code wh…EPSS 0.36%8.8CVE-2023-40695Ibm cognos controller insufficient session expiration vulnerabilityIBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to impersonate anot…EPSS 0.35%

Source: NIST National Vulnerability Database (record CVE-2023-38724), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.