« Back to list

CVE-2014-4810

Status: ModifiedMedium (4.3)—

IBM Cognos Mobile 10.1.1 before FP3 IF1, 10.2.0 before FP2 IF1, and 10.2.1 before FP4 IF1 preserves a session between the Cognos Mobile server and the Cognos Business Intelligence server after a logoff action on a mobile device, which makes it easier for remote attackers to bypass intended Business Intelligence restrictions by leveraging access to authentication data that was captured before this logoff.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

IBM — Cognos Mobile

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2014-4810",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-11-05T11:55:06.327",
  "references": [
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21684608",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95386",
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21684608",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95386",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Cognos Mobile 10.1.1 before FP3 IF1, 10.2.0 before FP2 IF1, and 10.2.1 before FP4 IF1 preserves a session between the Cognos Mobile server and the Cognos Business Intelligence server after a logoff action on a mobile device, which makes it easier for remote attackers to bypass intended Business Intelligence restrictions by leveraging access to authentication data that was captured before this logoff."
    },
    {
      "lang": "es",
      "value": "IBM Cognos Mobile 10.1.1 anterior a FP3 IF1, 10.2.0 anterior a FP2 IF1, y 10.2.1 anterior a FP4 IF1 preserva la sesión entre el servidor Cognos Mobile y el servidor Cognos Business Intelligence después de una acción de cierre de sesión en un dispositivo móvil, lo que facilita a atacantes remotos evadir las restricciones Business Intelligence mediante el aprovechamiento del acceso a datos de autenticación que fueron capturados anteriormente a este cierre de sesión."
    }
  ],
  "lastModified": "2026-06-17T00:10:37.310",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:cognos_mobile:10.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2802EAD4-4FDD-429A-86F1-F58DC0D2BA4D"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cognos_mobile:10.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "565F96DB-4A7D-45F8-AA04-68C46E4AE749"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cognos_mobile:10.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B03EAD61-EC44-425C-BDA4-AB4AF5497796"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}