CVE-2023-40695 is a medium severity flaw in IBM Cognos Controller 10.4.1, 10.4.2 and 11.0.0. NVD scores it 6.3. The product does not invalidate a session after logout, so an authenticated user could impersonate another. IBM's fixes are 11.0.1 FP2, 10.4.2 FP3 and 10.4.1 FP1.
What's affected
IBM's bulletin, titled "IBM Controller has addressed multiple vulnerabilities", lists IBM Controller 11.0.0, 10.4.2 and 10.4.1 as affected. The weakness is CWE-613, insufficient session expiration.
Fixes named by IBM:
- 11.0.0: download IBM Cognos Controller 11.0.1 FP2 from Fix Central.
- 10.4.2: download IBM Cognos Controller 10.4.2 FP3.
- 10.4.1: download IBM Cognos Controller 10.4.1 FP1.
- Controller on Cloud 11.x and 10.4.2.x environments: IBM says these have already been updated.
The bulletin lists no workarounds. Its initial publication date is 1 May 2024. IBM and NVD agree on 6.3 and on the vector. The same bulletin also covers CVE-2023-40696, a separate weak cryptography issue in the same product, which has its own post.
Not in CISA's KEV catalog. The bulletin does not say it is exploited in the wild.
How to check if you're exposed
Check which Controller version you run and whether the matching fix pack is installed. Your administrators can read the version from the product or from installation records.
Then check how users reach the application. The weakness only matters where more than one person can use the same browser or where a session identifier could be captured. Shared workstations and kiosks are the clearest case. If your users sign in from personal devices only, the practical risk is lower, but the fix is still needed.
What to do now
- Find every Cognos Controller instance you run and its version.
- Download and apply the matching fix: 11.0.1 FP2, 10.4.2 FP3 or 10.4.1 FP1. Cloud customers need no action beyond confirming with IBM.
- Ask users on shared machines to close the browser as well as logging out until the update is installed.
- Review session timeout settings in your environment so idle sessions end sooner.
- Record the fix level in your inventory and note that the same bulletin also resolves CVE-2023-40696.
Why it matters
When a user logs out, the server is supposed to discard the session so the old identifier cannot be used again. If it does not, whoever holds that identifier can keep acting as that user. That is the plain meaning of insufficient session expiration.
The score is medium because exploitation needs an authenticated user and gives limited impact on each of the three areas. Controller handles financial consolidation, so even a limited impersonation can matter in an audit. The fix is small, and it is worth applying with the other fixes in the same bulletin.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does logging out protect me before I patch?
Not fully. The flaw is that the session stays valid after logout, so closing the browser and avoiding shared machines is a sensible interim step.
Is this the same as CVE-2023-40696?
No. Both are in the same IBM bulletin, but CVE-2023-40696 covers weak cryptography rather than session handling.
Sources
- IBM security bulletin for IBM Controller
- IBM X-Force entry 264938
- Safeguard Gold entry for CVE-2023-40695
Last reviewed: 19 October 2026.
