IBM Cognos Controller and IBM Controller Improper Certificate Validation Vulnerability Allowing Unauthorized Access

A vulnerability exists in IBM Cognos Controller versions 11.0.0 through 11.0.1 and IBM Controller version 11.1.0. This vulnerability allows unauthorized users to obtain valid tokens, granting access to protected resources. The issue arises from improper validation of certificates, which could be exploited to bypass security measures and access sensitive information or functionalities.

Impact

Exploitation of this vulnerability could lead to unauthorized access to protected resources, allowing users to gain access to sensitive information or functionalities that should be restricted.

Remediation

Users are advised to upgrade to IBM Controller 11.1.0.1 or IBM Cognos Controller 11.0.1 FP3. Instructions for downloading these versions are available on the IBM Support website.