IBM Cognos Controller and IBM Controller Session Cookie Signing Vulnerability Allowing Sensitive Information Disclosure

A vulnerability exists in IBM Cognos Controller versions 11.0.0 to 11.0.1 and IBM Controller versions 11.1.0 to 11.1.1. The issue arises from the use of hardcoded cryptographic keys for signing session cookies, which could allow an attacker to obtain sensitive information.

Impact

Exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive information.

Remediation

Users are advised to apply the available interim fix through IBM Fix Central. Instructions for downloading the patch are available on the IBM Support page.