PT-2025-1040 · Ibm · Ibm Cognos Controller+1

Published 2025-01-06 · Updated 2025-01-07 · CVE-2024-25037

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Cognos Controller versions 11.0.0 through 11.0.1 IBM Controller version 11.1.0

Description The issue is related to the error reporting mechanism in IBM Cognos Controller and IBM Controller, which could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. This is due to shortcomings in the error reporting mechanism. The exploitation of this issue may enable an unauthorized party to gain access to protected information.

Recommendations For IBM Cognos Controller versions 11.0.0 through 11.0.1, consider disabling the error reporting feature that returns stack traces in the browser until a patch is available. For IBM Controller version 11.1.0, restrict access to the error reporting module to minimize the risk of exploitation. As a temporary workaround, avoid displaying stack traces in the browser for all affected versions until the issue is resolved.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BDU:2025-00252

CVE-2024-25037

Affected Products

Ibm Cognos Controller

Ibm Controller

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-25037 · Security Note
• https://bdu.fstec.ru/vul/2025-00252 · Security Note
• https://ibm.com/support/pages/node/7179163 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25037 · Vendor Advisory
• https://twitter.com/CVEnew/status/1876662293448016189 · Twitter Post