CVE-2024-56344

IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7287211

Configurations

No configuration.

History

28 Sep 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) IBM Cognos Analytics 12.0.4 hasta 12.0.4 FP2, y 12.1.0 hasta 12.1.3 FP1 podría permitir a un atacante remoto obtener información sensible, causado por la falla al habilitar correctamente HTTP Strict Transport Security. Un atacante podría explotar esta vulnerabilidad para obtener información sensible utilizando técnicas de man in the middle.

18 Sep 2026, 15:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-18 15:17

Updated : 2026-09-28 14:10

NVD link : CVE-2024-56344

Mitre link : CVE-2024-56344

CVE.ORG link : CVE-2024-56344

JSON object : View

Products Affected

No product.

CWE

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

{"id": "CVE-2024-56344", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-56344", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-19T13:45:22.293972Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:cognos_analytics:12.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:cognos_analytics:12.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:cognos_analytics:12.1.3:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Cognos Analytics", "versions": [{"status": "affected", "version": "12.0.4", "versionType": "semver", "lessThanOrEqual": "12.0.4 FP2"}, {"status": "affected", "version": "12.1.0", "versionType": "semver", "lessThanOrEqual": "12.1.3 FP1"}]}]}], "published": "2026-09-18T15:17:03.947", "references": [{"url": "https://www.ibm.com/support/pages/node/7287211", "source": "psirt@us.ibm.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-327"}]}], "descriptions": [{"lang": "en", "value": "IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques."}, {"lang": "es", "value": "IBM Cognos Analytics 12.0.4 hasta 12.0.4 FP2, y 12.1.0 hasta 12.1.3 FP1 podr\u00eda permitir a un atacante remoto obtener informaci\u00f3n sensible, causado por la falla al habilitar correctamente HTTP Strict Transport Security. Un atacante podr\u00eda explotar esta vulnerabilidad para obtener informaci\u00f3n sensible utilizando t\u00e9cnicas de man in the middle."}], "lastModified": "2026-09-28T14:10:00.213", "sourceIdentifier": "psirt@us.ibm.com"}