PT-2024-31422 · Ibm · Ibm Cognos Analytics

Published 2024-12-18 · Updated 2025-01-10 · CVE-2024-45082

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics versions 11.2.0 through 11.2.4 IBM Cognos Analytics versions 12.0.0 through 12.0.3

Description The issue could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed and redirect a user to a malicious Web site that would appear to be trusted.

Recommendations For versions 11.2.0 through 11.2.4, consider disabling any functionality that may be leveraging open redirects until a patch is available. For versions 12.0.0 through 12.0.3, restrict access to any modules or functions that could be used to conduct phishing attacks, minimizing the risk of exploitation. As a temporary workaround, consider implementing additional validation on URL redirects to minimize the risk of open redirect attacks.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-45082

Affected Products

Ibm Cognos Analytics

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-45082 · Security Note
• https://ibm.com/support/pages/node/7177223 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45082 · Vendor Advisory
• https://twitter.com/CVEnew/status/1869423938562040125 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1869450318112608699 · Twitter Post
• https://t.me/cvedetector/13217 · Telegram Post