Detections
Analytics
IBM Cognos Analytics 11.2.x < 11.2.4 FP5 / 12.0.x < 12.0.4 IF1 Multiple Vulnerabilities (7179496)
high Nessus Plugin ID 213474
Language:
Synopsis
The remote host is missing one or more security updates.Description
The version of IBM Cognos Analytics installed on the remote host is prior to 11.2.4 FP5 or 12.0.4 IF1. It is, therefore, affected by multiple vulnerabilities as referenced in the 7179496 advisory.- IBM Cognos Analytics is vulnerable to an Expression Language (EL) Injection vulnerability. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, and/or cause the server to crash when using a specially crafted EL statement. (CVE-2024-51466)
- IBM Cognos Analytics could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks. (CVE-2024-40695)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to IBM Cognos Analytics version 11.2.4 FP5 / 12.0.4 IF1 or later.See Also
Plugin Details
Severity: High
ID: 213474
File Name: ibm_cognos_7179496.nasl
Version: 1.1
Type: remote
Family: CGI abuses
Published: 1/3/2025
Updated: 1/3/2025
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.1
CVSS v2
Risk Factor: High
Base Score: 8.5
Vector: CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2024-40695
CVSS v3
Risk Factor: High
Base Score: 8
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Vulnerability Information
CPE: cpe:/a:ibm:cognos_analytics
Required KB Items: installed_sw/IBM Cognos Analytics
Patch Publication Date: 12/19/2024
Vulnerability Publication Date: 12/19/2024
Reference Information
CVE: CVE-2024-40695, CVE-2024-51466
IAVB: 2025-B-0001