CVE-2020-4685

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-11-11 · updated 2026-06-17

Description

A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the application is installed, can escalate their privilege from Low level to Super Admin and gain access to Create/Update/Delete any level of user in Cognos Controller. IBM X-Force ID: 186625.

Affected products

IBM Cognos Controller: 10.3.0, 10.3.1, 10.4.0, 10.4.1, 10.4.2

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/186625
https://www.ibm.com/support/pages/node/6339995
https://exchange.xforce.ibmcloud.com/vulnerabilities/186625
https://www.ibm.com/support/pages/node/6339995

Get alerted when CVE-2020-4685 or the next vulnerability affects your stack