CVE-2023-35011

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 257705.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
IBM	Cognos Analytics	11.1.7, 11.2.0, 11.2.1

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/257705VDB Entry, Vendor Advisory
https://security.netapp.com/advisory/ntap-20230921-0005/
https://security.netapp.com/advisory/ntap-20240621-0005/
https://www.ibm.com/support/pages/node/7026692Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/257705VDB Entry, Vendor Advisory
https://security.netapp.com/advisory/ntap-20230921-0005/
https://security.netapp.com/advisory/ntap-20240621-0005/
https://www.ibm.com/support/pages/node/7026692Patch, Vendor Advisory

Timeline

Published: Aug 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-350126.7IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 with a Federated configuration is vulnerable to a stack-based buffer CVE-2023-350134.4IBM Security Verify Governance 10.0, Identity Manager could allow a local privileged user to obtain sensitive information from source code. CVE-2023-350166.5IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could CVE-2023-350175.9IBM Security Verify Governance 10.0.2 Identity Manager can transmit user credentials in clear text that could be obtained by an attacker usi CVE-2023-350187.2IBM Security Verify Governance 10.0 could allow a privileged use to upload arbitrary files due to improper file validation. IBM X-Force ID:CVE-2023-350198.8IBM Security Verify Governance, Identity Manager 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the syste CVE-2023-35027.5A vulnerability, which was classified as critical, was found in SourceCodester Shopping Website 1.0. Affected is an unknown function of the CVE-2023-350205.3IBM Sterling Control Center 6.3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially cr CVE-2023-350223.3IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X CVE-2023-350247.6IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1 CVE-2023-350296.1Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update CVE-2023-35038.8A vulnerability has been found in SourceCodester Shopping Website 1.0 and classified as critical. Affected by this vulnerability is an unkno