CVE-2024-25047

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-25047
IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided data. This could lead to further attacks against the system. IBM X-Force ID: 282956.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/282956 VDB Entry Vendor Advisory
https://security.netapp.com/advisory/ntap-20240621-0007/ Third Party Advisory
https://www.ibm.com/support/pages/node/7149874 Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/282956 VDB Entry Vendor Advisory
https://security.netapp.com/advisory/ntap-20240621-0007/ Third Party Advisory
https://www.ibm.com/support/pages/node/7149874 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack1:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack2:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
History

02 Jul 2025, 15:41

Type Values Removed Values Added
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/282956 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/282956 - VDB Entry, Vendor Advisory
References () https://security.netapp.com/advisory/ntap-20240621-0007/ - () https://security.netapp.com/advisory/ntap-20240621-0007/ - Third Party Advisory
References () https://www.ibm.com/support/pages/node/7149874 - () https://www.ibm.com/support/pages/node/7149874 - Patch, Vendor Advisory
First Time Netapp
Netapp oncommand Insight
Ibm cognos Analytics
Ibm
CPE cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack2:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack1:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*

21 Nov 2024, 09:00

Type Values Removed Values Added
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/282956 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/282956 -
References () https://security.netapp.com/advisory/ntap-20240621-0007/ - () https://security.netapp.com/advisory/ntap-20240621-0007/ -
References () https://www.ibm.com/support/pages/node/7149874 - () https://www.ibm.com/support/pages/node/7149874 -

21 Jun 2024, 19:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240621-0007/ -

03 May 2024, 12:50

Type Values Removed Values Added
Summary
  • (es) IBM Cognos Analytics 11.2.0 a 11.2.4 y 12.0.0 a 12.0.2 es vulnerable a ataques de inyección en el registro de aplicaciones al no sanitizar los datos proporcionados por el usuario. Esto podría dar lugar a nuevos ataques contra el sistema. ID de IBM X-Force: 282956.

02 May 2024, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-02 21:16

Updated : 2025-07-02 15:41

NVD link : CVE-2024-25047

Mitre link : CVE-2024-25047

CVE.ORG link : CVE-2024-25047

JSON object : View

Products Affected

netapp

  • oncommand_insight

ibm

  • cognos_analytics
CWE
CWE-117

Improper Output Neutralization for Logs