CVE-2021-20450

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-20450
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 196640.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/196640 Vendor Advisory
https://www.ibm.com/support/pages/node/7149876 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/196640 Vendor Advisory
https://www.ibm.com/support/pages/node/7149876 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ibm:cognos_controller:10.4.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_controller:10.4.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*
History

18 Jun 2025, 15:21

Type Values Removed Values Added
CPE cpe:2.3:a:ibm:cognos_controller:10.4.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_controller:10.4.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*
First Time Ibm cognos Controller
Ibm
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/196640 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/196640 - Vendor Advisory
References () https://www.ibm.com/support/pages/node/7149876 - () https://www.ibm.com/support/pages/node/7149876 - Vendor Advisory

05 Dec 2024, 21:15

Type Values Removed Values Added
CWE CWE-565

21 Nov 2024, 05:46

Type Values Removed Values Added
Summary
  • (es) IBM Cognos Controller 10.4.1, 10.4.2 y 11.0.0 no establece el atributo seguro en los tokens de autorización ni en las cookies de sesión. Los atacantes pueden obtener los valores de las cookies enviando un enlace http:// a un usuario o colocando este enlace en un sitio al que accede el usuario. La cookie se enviará al enlace inseguro y el atacante podrá obtener el valor de la cookie espiando el tráfico. ID de IBM X-Force: 196640.
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/196640 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/196640 -
References () https://www.ibm.com/support/pages/node/7149876 - () https://www.ibm.com/support/pages/node/7149876 -

03 May 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-03 17:15

Updated : 2025-06-18 15:21

NVD link : CVE-2021-20450

Mitre link : CVE-2021-20450

CVE.ORG link : CVE-2021-20450

JSON object : View

Products Affected

ibm

  • cognos_controller
CWE
CWE-565

Reliance on Cookies without Validation and Integrity Checking