CVE-2024-25037

Name of the Vulnerable Software and Affected Versions IBM Cognos Controller versions 11.0.0 through 11.0.1 IBM Controller version 11.1.0

Description The issue is related to the error reporting mechanism in IBM Cognos Controller and IBM Controller, which could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. This is due to shortcomings in the error reporting mechanism. The exploitation of this issue may enable an unauthorized party to gain access to protected information.

Recommendations For IBM Cognos Controller versions 11.0.0 through 11.0.1, consider disabling the error reporting feature that returns stack traces in the browser until a patch is available. For IBM Controller version 11.1.0, restrict access to the error reporting module to minimize the risk of exploitation. As a temporary workaround, avoid displaying stack traces in the browser for all affected versions until the issue is resolved.