CVE-2024-25047

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided data. This could lead to further attacks against the system. IBM X-Force ID: 282956.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-117

Affected software

Vendor	Product	Versions
IBM	Cognos Analytics	11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2
ibm	cognos_analytics	11.2.0 <= 11.2.4, 12.0.0 <= 12.0.2

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/282956VDB Entry, Vendor Advisory
https://security.netapp.com/advisory/ntap-20240621-0007/Third Party Advisory
https://www.ibm.com/support/pages/node/7149874Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/282956VDB Entry, Vendor Advisory
https://security.netapp.com/advisory/ntap-20240621-0007/Third Party Advisory
https://www.ibm.com/support/pages/node/7149874Patch, Vendor Advisory

Timeline

Published: May 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-250487.5IBM MQ Appliance 9.3 CD and LTS are vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote authenticated a CVE-2024-25058.1The GamiPress WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings, permitting Author CVE-2024-250507.8IBM i 7.2, 7.3, 7.4, 7.5 and IBM Rational Development Studio for i 7.2, 7.3, 7.4, 7.5 networking and compiler infrastructure could allow a l CVE-2024-250517.2IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to im CVE-2024-250524.4IBM Jazz Reporting Service 7.0.3 stores user credentials in plain clear text which can be read by an admin user. IBM X-Force ID: 283363.CVE-2024-250535.9IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation whe CVE-2024-25066.4The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to Stored Cross-Site Scri CVE-2024-250627.5An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XIncl CVE-2024-250637.5Due to insufficient server-side validation, a successful exploit of this vulnerability could allow an attacker to gain access to certain URL CVE-2024-250644.3Due to insufficient server-side validation, an attacker with login privileges could access certain resources that the attacker should not ha CVE-2024-250659.1Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the CVE-2024-250664.3RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-control