CVE-2020-4685 Privilege escalation in Cognos Controller
A low-level user with server administration rights can escalate privileges to Super Admin, allowing them to create, update, or delete any user in IBM Cognos Controller.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-4685?
CVE-2020-4685 is a high-severity vulnerability in Ibm Cognos Controller, published on 11 Nov 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the application is installed, can escalate their privilege from Low level to Super Admin and gain access to Create/Update/Delete any level of user in Cognos Controller. IBM X-Force ID: 186625.
Which versions are affected by CVE-2020-4685?
It affects 1 product.
Products include Ibm Cognos Controller.
How do I fix CVE-2020-4685?
No fix has been published for CVE-2020-4685 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-4685 being exploited?
There is no known exploitation of CVE-2020-4685 in the wild and no public exploit code.
Other vulnerabilities in Ibm Cognos Controller
Sources
Also known as GHSA-jv3x-w786-8ggq.