CVE-2024-25019: IBM Cognos Controller file upload
First published: Tue Dec 03 2024(Updated: )
IBM Cognos Controller 11.0.0 and 11.0.1 could be vulnerable to malicious file upload by not validating the type of file uploaded to Journal entry attachments. Attackers can make use of this weakness and upload malicious executable files into the system that can be sent to victims for performing further attacks.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Cognos Controller | <=11.0.0 - 11.0.1 | |
| IBM Cognos Controller | =11.0.0 | |
| IBM Cognos Controller | =11.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-25019?
CVE-2024-25019 is considered a high severity vulnerability due to the risk of malicious file upload.
How do I fix CVE-2024-25019?
To fix CVE-2024-25019, ensure that proper file type validation is implemented for Journal entry attachments.
What are the potential impacts of CVE-2024-25019?
The potential impacts of CVE-2024-25019 include unauthorized access and execution of malicious code on the system.
Which IBM Cognos Controller versions are affected by CVE-2024-25019?
Versions 11.0.0 and 11.0.1 of IBM Cognos Controller are affected by CVE-2024-25019.
Is there a workaround for CVE-2024-25019?
A possible workaround for CVE-2024-25019 includes restricting file upload permissions until a proper fix is applied.
- agent/references
- agent/title
- agent/first-publish-date
- agent/type
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/weakness
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/trending
- agent/tags
- agent/source
- vendor/ibm
- canonical/ibm cognos controller
- version/ibm cognos controller/11.0.0 - 11.0.1
- version/ibm cognos controller/11.0.0
- version/ibm cognos controller/11.0.1