CVE-2023-38009 - Vulnerability Details - OpenCVE

IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning.

No CVSS v4.0

Attack Vector Physical

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ibm	Cognos Analytics Mobile

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7172691
https://www.ibm.com/support/pages/node/7172692

History

Mon, 27 Jan 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sun, 26 Jan 2025 16:15:00 +0000

Type	Values Removed	Values Added
Description		IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning.
Title		IBM Cognos Analytics Mobile information disclosure
First Time appeared		Ibm Ibm cognos Analytics Mobile
Weaknesses		CWE-295
CPEs		cpe:2.3:a:ibm:cognos_analytics_mobile:1.1:::::android:: cpe:2.3:a:ibm:cognos_analytics_mobile:1.1:::::ios::
Vendors & Products		Ibm Ibm cognos Analytics Mobile
References		https://www.ibm.com/support/pages/node/7172691 https://www.ibm.com/support/pages/node/7172692
Metrics		cvssV3_1 `{'score': 4.2, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2025-01-26T15:57:42.477Z

Updated: 2025-01-27T14:52:09.533Z

Reserved: 2023-07-11T17:33:11.276Z

Link: CVE-2023-38009

Vulnrichment

Updated: 2025-01-27T14:39:40.217Z

NVD

Status : Received

Published: 2025-01-26T16:15:30.033

Modified: 2025-01-26T16:15:30.033

Link: CVE-2023-38009

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-38009", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2023-07-11T17:33:11.276Z", "datePublished": "2025-01-26T15:57:42.477Z", "dateUpdated": "2025-01-27T14:52:09.533Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:cognos_analytics_mobile:1.1:*:*:*:*:ios:*:*"], "defaultStatus": "unaffected", "platforms": ["iOS"], "product": "Cognos Analytics Mobile", "vendor": "IBM", "versions": [{"status": "affected", "version": "1.1"}]}, {"cpes": ["cpe:2.3:a:ibm:cognos_analytics_mobile:1.1:*:*:*:*:android:*:*"], "defaultStatus": "unaffected", "platforms": ["Android"], "product": "Cognos Analytics Mobile", "vendor": "IBM", "versions": [{"status": "affected", "version": "1.1"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning."}], "value": "IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-01-26T15:57:42.477Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/7172691"}, {"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/7172692"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Cognos Analytics Mobile information disclosure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-27T14:39:38.494450Z", "id": "CVE-2023-38009", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-27T14:52:09.533Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "IBM Cognos Analytics Mobile information disclosure", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:cognos_analytics_mobile:1.1:*:*:*:*:ios:*:*"], "vendor": "IBM", "product": "Cognos Analytics Mobile", "versions": [{"status": "affected", "version": "1.1"}], "platforms": ["iOS"], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:ibm:cognos_analytics_mobile:1.1:*:*:*:*:android:*:*"], "vendor": "IBM", "product": "Cognos Analytics Mobile", "versions": [{"status": "affected", "version": "1.1"}], "platforms": ["Android"], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.ibm.com/support/pages/node/7172691", "tags": ["vendor-advisory"]}, {"url": "https://www.ibm.com/support/pages/node/7172692", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning.", "supportingMedia": [{"type": "text/html", "value": "IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-01-26T15:57:42.477Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-38009", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-27T14:39:38.494450Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2025-01-27T14:39:40.217Z"}}]}, "cveMetadata": {"cveId": "CVE-2023-38009", "state": "PUBLISHED", "dateUpdated": "2025-01-26T15:57:42.477Z", "dateReserved": "2023-07-11T17:33:11.276Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2025-01-26T15:57:42.477Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}