PT-2024-20717 · Ibm · Ibm Cognos Analytics

Published 2024-05-02 · Updated 2025-07-02 · CVE-2024-25047

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics versions 11.2.0 through 11.2.4 IBM Cognos Analytics versions 12.0.0 through 12.0.2

Description The issue is related to injection attacks in application logging due to the lack of sanitization of user-provided data. This could lead to further attacks against the system.

Recommendations For IBM Cognos Analytics versions 11.2.0 through 11.2.4, upgrade to a patched version to address improper output handling. For IBM Cognos Analytics versions 12.0.0 through 12.0.2, upgrade to a patched version to address improper output handling. As a temporary workaround, consider auditing logs for suspicious activity to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-117

Related Identifiers

CVE-2024-25047

Affected Products

Ibm Cognos Analytics

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-25047 · Security Note
• https://ibm.com/support/pages/node/7149874 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/282956 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25047 · Vendor Advisory
• https://t.me/cvenotify/127399 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1786162817793396932 · Twitter Post
• https://security.netapp.com/advisory/ntap-20240621-0007 · Note
• https://twitter.com/CVEnew/status/1786145069109764109 · Twitter Post
• https://twitter.com/oktsec/status/1786222423563543021 · Twitter Post
• https://t.me/cvenotify/78918 · Telegram Post