PT-2025-5684 · Ibm · Ibm Cognos Analytics

Published 2025-02-05 · Updated 2025-07-02 · CVE-2024-49352

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.2.0 through 12.0.4

Description: The issue is related to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources.

Recommendations: For IBM Cognos Analytics versions 11.2.0 through 12.0.4, consider disabling XML data processing until a patch is available. Restrict access to sensitive information and monitor memory resources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2025-06485

CVE-2024-49352

Affected Products

Ibm Cognos Analytics

References · 9

• https://ibm.com/support/pages/node/7181480 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49352 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49352 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06485 · Security Note
• https://t.me/cvenotify/127419 · Telegram Post
• https://twitter.com/CVEnew/status/1887100037697790240 · Twitter Post
• https://t.me/cvedetector/17279 · Telegram Post
• https://t.me/cvenotify/110081 · Telegram Post
• https://twitter.com/cracbot/status/1888905845129494760 · Twitter Post