CVE-2024-28778: IBM Cognos Controller information disclosure
IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 is vulnerable to exposure of Artifactory API keys. This vulnerability allows users to publish code to private packages or repositories under the name of the organization.
Other sources
IBM Cognos Controller is vulnerable to exposure of Artifactory API keys. This vulnerability allows users to publish code to private packages or repositories under the name of the organization.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28778?
CVE-2024-28778 has been rated as a critical vulnerability due to the potential exposure of sensitive API keys.
How do I fix CVE-2024-28778?
To mitigate CVE-2024-28778, update IBM Cognos Controller to versions 11.0.2 or later, or IBM Controller to version 11.1.1 or later.
Which versions are affected by CVE-2024-28778?
CVE-2024-28778 affects IBM Cognos Controller versions 11.0.0 through 11.0.1 and IBM Controller version 11.1.0.
What is the impact of CVE-2024-28778?
The impact of CVE-2024-28778 includes unauthorized code publishing to private repositories, which could lead to reputation damage and data compromise.
Is there a workaround for CVE-2024-28778?
As a temporary workaround for CVE-2024-28778, organizations should restrict access to the Artifactory API until an upgrade can be performed.