CVE-2023-38724 is a Medium severity (CVSS 6.3) SQL injection flaw in IBM Cognos Controller 10.4.1, 10.4.2 and 11.0.0. An authenticated remote attacker could read or change data in the back-end database. IBM's fix is a fix pack per version: 11.0.1 FP2, 10.4.2 FP3 or 10.4.1 FP1, with no workaround offered.
What's affected
IBM's bulletin lists three affected versions of the product, which it names IBM Controller: 11.0.0, 10.4.2 and 10.4.1. The NVD record agrees on the versions. The weakness was tracked by IBM as X-Force ID 262183.
IBM publishes a fix for each line:
- 11.0.0: IBM Cognos Controller 11.0.1 FP2
- 10.4.2: IBM Cognos Controller 10.4.2 FP3
- 10.4.1: IBM Cognos Controller 10.4.1 FP1
IBM says its hosted offerings, Controller on Cloud 11.x and 10.4.2.x, have already been updated, so cloud customers do not need to act. IBM lists workarounds and mitigations as none.
This CVE sits in a bulletin that covers many vulnerabilities, including several in third-party Java libraries. Applying the listed fix pack addresses the whole bulletin, not only this one issue.
How to check if you're exposed
Start by identifying which Controller version each environment runs. Use the version information your Controller installation or administration console reports, and compare it to the three versions above. Production, test and disaster recovery copies often drift apart, so check each one.
Then check whether the fix pack is already in place. The bulletin names the fix pack level for each version, so a build at or above 11.0.1 FP2, 10.4.2 FP3 or 10.4.1 FP1 is on the fixed line. If your support portal shows a different fix naming scheme, treat IBM's bulletin as the reference.
Because the flaw needs a valid login (the vector shows low privileges required), also review who holds Controller accounts. A long list of rarely used accounts widens the set of people who could reach the vulnerable code.
What to do now
- List every IBM Cognos Controller instance and its version, including non-production copies.
- Download the fix pack for your line from IBM Fix Central: 11.0.1 FP2, 10.4.2 FP3 or 10.4.1 FP1.
- Apply it in a test environment first, then production, and confirm the finance close process still runs.
- Review accounts with access to Controller and remove ones that are no longer needed, since exploitation needs a login.
- Check database audit logs on the Controller database for unexpected queries or changes in the period before patching.
Why it matters
The weakness is CWE-89 (SQL injection): input reaches a database query without being kept separate from the query itself. The result, as IBM describes it, is that a remote attacker could view, add, modify or delete information in the back-end database.
The score is held at 6.3 because the attacker needs a low-privilege account (PR:L) and the record rates each of confidentiality, integrity and availability impact as low. For a financial consolidation system, though, even limited changes to the database matter, because the data feeds reporting. The record does not mark this CVE as exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog. Treat it as a routine but real patch for a system that holds financial data.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need credentials to use this flaw?
Yes. The vector requires low privileges (PR:L), so the attacker needs a valid account on the system, according to the CVSS data in the record and the IBM bulletin.
Is there a workaround if I cannot patch?
IBM lists workarounds and mitigations as none for this bulletin. The supported route is to apply the fix pack for your version.
Sources
- IBM Security Bulletin: IBM Controller has addressed multiple vulnerabilities
- IBM X-Force entry 262183 (listed in the record; not retrievable when reviewed)
- Record data for CVE-2023-38724
Last reviewed: 19 October 2026.
