CVE-2023-32344 MEDIUM

CVE-2023-32344: IBM Cognos Analytics cross-site request forgery

Vendor Ibm

Product Cognos Analytics

Weakness CWE-352 · CSRF

Published February 24, 2024

Last update February 13, 2025

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path. IBM X-Force ID: 255898.

Key dates

02Disclosure timeline

February 24, 2024 CVE published

February 13, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-32344 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html

Related vulnerabilities

04Related CVE

CVE-2023-24382 WordPress Material Design Icons for Page Builders Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2025-13990 Mamurjor Employee Info <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Employee and Related Data Manipulation CVE-2024-35689 WordPress Analytify plugin <= 5.2.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-25128 WordPress Facilita Form Tracker plugin <= 1.0 - CSRF to Stored XSS vulnerability CVE-2021-23227 WordPress PHP Everywhere Plugin <= 2.0.2 is vulnerable to Cross Site Request Forgery (CSRF)