« Volver al listado

CVE-2024-25042

Estado: AnalizadaMedia (6.1)—

IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3

is potentially vulnerable to Cross Site Scripting (XSS). A remote attacker could execute malicious commands due to improper validation of column headings in Cognos Explorations.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Cognos Analytics

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-25042",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-25042",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-18T19:34:20.464608Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:cognos_analytics:11.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:11.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:11.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:11.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:11.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:12.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:12.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:12.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:12.0.3:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Cognos Analytics",
          "versions": [
            {
              "status": "affected",
              "version": "11.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "11.2.4"
            },
            {
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "12.0.3"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-12-18T17:15:13.057",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7173592",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 \n\n\n\nis potentially vulnerable to Cross Site Scripting (XSS). A remote attacker could execute malicious commands due to improper validation of column headings in Cognos Explorations."
    },
    {
      "lang": "es",
      "value": "IBM Cognos Analytics 11.2.0 a 11.2.4 y 12.0.0 a 12.0.3 es potencialmente vulnerable a Cross Site Scripting (XSS). Un atacante remoto podría ejecutar comandos maliciosos debido a una validación incorrecta de los encabezados de columna en Cognos Explorations."
    }
  ],
  "lastModified": "2026-06-17T07:15:25.090",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "792D3191-C65E-41C3-834D-45F162020756",
              "versionEndIncluding": "11.2.4",
              "versionStartIncluding": "11.2.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C1AE531-B015-421A-84A2-2F0C9E50312D",
              "versionEndIncluding": "12.0.3",
              "versionStartIncluding": "12.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}