PT-2025-9048 · Ibm · Ibm Cognos Analytics

Mario Tesoro · Published 2025-02-28 · Updated 2025-10-17 · CVE-2024-56340

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics versions 11.2.0 through 11.2.4 FP5

Description The issue allows an attacker to access sensitive files by inserting path traversal payloads inside the deficon parameter, enabling local file inclusion.

Recommendations For versions 11.2.0 through 11.2.4 FP5, avoid using the deficon parameter in affected API endpoints until the issue is resolved.

Exploit

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2024-56340

Affected Products

Ibm Cognos Analytics

References · 9

• 🔥 https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-56340 · Exploit
• https://osv.dev/vulnerability/CVE-2024-56340 · Vendor Advisory
• https://ibm.com/support/pages/node/7183676 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56340 · Security Note
• https://t.me/cvenotify/112745 · Telegram Post
• https://t.me/cvenotify/127420 · Telegram Post
• https://t.me/cveNotify/139193 · Telegram Post
• https://t.me/cvedetector/19113 · Telegram Post
• https://twitter.com/CVEnew/status/1895619351732261141 · Twitter Post