PT-2025-7434 · Ibm · Ibm Controller+1

Published 2024-11-17 · Updated 2025-02-19 · CVE-2024-52902

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Cognos Controller versions 11.0.0 through 11.0.1 FP3 IBM Controller version 11.1.0

Description The issue concerns hard-coded database passwords in the source code of the client application, which could be used for unauthorized access to the system.

Recommendations For IBM Cognos Controller versions 11.0.0 through 11.0.1 FP3, consider removing or modifying the hard-coded database passwords to prevent unauthorized access. For IBM Controller version 11.1.0, remove or modify the hard-coded database passwords in the client application to minimize the risk of exploitation. As a temporary workaround, restrict access to the database until the hard-coded passwords are removed or modified.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2025-02075

CVE-2024-52902

Affected Products

Ibm Cognos Controller

Ibm Controller

References · 8

• https://osv.dev/vulnerability/CVE-2024-52902 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52902 · Security Note
• https://bdu.fstec.ru/vul/2025-02075 · Security Note
• https://ibm.com/support/pages/node/7183597 · Vendor Advisory, Patch
• https://twitter.com/CveFindCom/status/1892228139658440820 · Twitter Post
• https://twitter.com/CVEnew/status/1892231508565401883 · Twitter Post
• https://t.me/cvedetector/18445 · Telegram Post
• https://vuldb.com/?id.296289 · Note