A security issue has been reported in IBM Cognos Express, which can be exploited by malicious people to bypass certain security restrictions.

The problem is caused due to the existence of a hidden manager-level account that reportedly has hard-coded credentials to Tomcat Manager. This can be exploited by bypass user authentication and log in with manager privileges and e.g. manage and deploy servlets onto the server.

Solution
The vendor has published steps to address the security issue by deleting various files and folders.

Provided and/or discovered by
AbdulAziz Hariri of Insight Technologies, reported via ZDI.

Changelog
Further details available in Customer Area

Original Advisory
IBM:
http://www-01.ibm.com/support/docview.wss?uid=swg21419179
http://www-01.ibm.com/support/docview.wss?uid=swg21419065

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-018/

Deep Links
Links available in Customer Area