PT-2024-20715 · Ibm · Ibm Cognos Analytics
CVE-2024-25042
·
Published
2024-12-18
·
Updated
2025-01-10
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
IBM Cognos Analytics versions 11.2.0 through 11.2.4
IBM Cognos Analytics versions 12.0.0 through 12.0.3
Description
The issue is related to a Cross Site Scripting (XSS) vulnerability due to improper validation of column headings in Cognos Explorations. A remote attacker could execute malicious commands.
Recommendations
For versions 11.2.0 through 11.2.4, consider disabling the Cognos Explorations feature until a patch is available.
For versions 12.0.0 through 12.0.3, restrict access to the Cognos Explorations module to minimize the risk of exploitation.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ibm Cognos Analytics