Vulnerability · Published Feb 24, 2024 · Assigned by ibm
CVE-2022-34357IBM Cognos Analytics Mobile Server denial of service
Medium 6.5
In plain English
A medium-severity resource allocation without limits in Cognos Analytics from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.2%top 31.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
IBM Cognos Analytics Mobile Server 11.1.7, 11.2.4, and 12.0.0 is vulnerable to Denial of Service due to due to weak or absence of rate limiting. By making unlimited http requests, it is possible for a single user to exhaust server resources over a period of time making service unavailable for other legitimate users. IBM X-Force ID: 230510.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IBM | Cognos Analytics | 11.1.7, 11.2.4, 12.0.0 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H