CVE-2023-32344

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path. IBM X-Force ID: 255898.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
IBM	Cognos Analytics	e

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/255898VDB Entry, Vendor Advisory
https://security.netapp.com/advisory/ntap-20240405-0002/Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0006/Third Party Advisory
https://www.ibm.com/support/pages/node/7123154Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/255898VDB Entry, Vendor Advisory
https://security.netapp.com/advisory/ntap-20240405-0002/Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0006/Third Party Advisory
https://www.ibm.com/support/pages/node/7123154Vendor Advisory

Timeline

Published: Feb 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-323465.3Teltonika’s Remote Management System versions prior to 4.10.0 contain a function that allows users to claim their devices. This function ret CVE-2023-323479.8Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify devices from the user CVE-2023-323485.8Teltonika’s Remote Management System versions prior to 4.10.0 contain a virtual private network (VPN) hub feature for cross-device communica CVE-2023-323498.8Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter par CVE-2023-32358.8A vulnerability was found in mccms up to 2.6.5. It has been rated as critical. Affected by this issue is the function pic_api of the file sy CVE-2023-323508.8Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a CVE-2023-323517.8A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.9 for Windows. An app may be able to gain elevated pri CVE-2023-323525.5A logic issue was addressed with improved checks. This issue is fixed in watchOS 9.5, macOS Ventura 13.4, macOS Big Sur 11.7.7, macOS Monter CVE-2023-323537.8A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.9 for Windows. An app may be able to elevate privilege CVE-2023-323545.5An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, iOS 16.5 and iPadOS 16.5.CVE-2023-323555.5A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventur CVE-2023-323567.8A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3. An app may be able to cause