IBM Cognos Controller and IBM Controller XML External Entity Injection Vulnerability

A vulnerability allowing XML External Entity (XXE) injection has been identified in IBM Cognos Controller versions 11.0.0 through 11.0.1 FP3, as well as in IBM Controller 11.1.0. This vulnerability arises when the application processes XML data, potentially allowing remote attackers to access sensitive information or exhaust memory resources.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information or cause memory exhaustion, potentially leading to a denial-of-service condition.

Remediation

Users are advised to upgrade to IBM Cognos Controller 11.0.1 FP4 or IBM Controller 11.1.0.1. Instructions for downloading these versions are available on the IBM Support website.