CVE-2021-20556 IBM Cognos Controller information disclosure
Remote attackers can enumerate valid usernames in IBM Cognos Controller due to inconsistent error messages, facilitating targeted attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20556?
CVE-2021-20556 is a medium-severity vulnerability in Ibm Cognos Controller, published on 3 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote user to enumerate usernames due to differentiating error messages on existing usernames. IBM X-Force ID: 199181.
Which versions are affected by CVE-2021-20556?
It affects 1 product.
Products include Ibm Cognos Controller.
How do I fix CVE-2021-20556?
No fix has been published for CVE-2021-20556 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-20556 being exploited?
There is no known exploitation of CVE-2021-20556 in the wild and no public exploit code.
Other vulnerabilities in Ibm Cognos Controller
Sources
Also known as GHSA-4grf-x53v-r95x.