CVE-2023-40695

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 264938.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
IBM	Cognos Controller	10.4.1, 10.4.2, 11.0.0

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/264938Vendor Advisory
https://www.ibm.com/support/pages/node/7149876Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/264938Vendor Advisory
https://www.ibm.com/support/pages/node/7149876Vendor Advisory

Timeline

Published: May 3, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-406967.5IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt CVE-2023-406997.5IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-F CVE-2023-40708.1Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML p CVE-2023-407027.7PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not requi CVE-2023-407037.5Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume CVE-2023-407049.8The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopard CVE-2023-407055.4Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inje CVE-2023-407069.8There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brut CVE-2023-407077.5There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could CVE-2023-407085.3The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access CVE-2023-407097.5An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enable CVE-2023-40718.8Heap buffer overflow in Visuals in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption vi