PT-2024-9788 · Ibm · Ibm Cognos Analytics

Published

2024-10-25

·

Updated

2025-07-02

·

CVE-2024-51466

CVSS v3.1

9.0

Critical

VectorAV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.2.0 through 11.2.4 FP4 IBM Cognos Analytics versions 12.0.0 through 12.0.4
Description: The issue is related to an Expression Language (EL) Injection vulnerability in IBM Cognos Analytics. This vulnerability can be exploited by a remote attacker to expose sensitive information, consume memory resources, and/or cause the server to crash when using a specially crafted EL statement.
Recommendations: For IBM Cognos Analytics versions 11.2.0 through 11.2.4 FP4, consider disabling the use of Expression Language (EL) statements until a patch is available. For IBM Cognos Analytics versions 12.0.0 through 12.0.4, restrict access to the EL injection vulnerability to minimize the risk of exploitation. As a temporary workaround, consider disabling the vulnerable EL functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-917

Related Identifiers

BDU:2024-11551
CVE-2024-51466

Affected Products

Ibm Cognos Analytics