« Volver al listado

CVE-2024-45082

Estado: AnalizadaMedia (5.2)—

IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3

could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Cognos Analytics

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-45082",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45082",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-18T19:35:56.748146Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.2,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:cognos_analytics:11.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:11.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:11.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:11.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:11.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:12.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:12.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:12.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_analytics:12.0.3:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Cognos Analytics",
          "versions": [
            {
              "status": "affected",
              "version": "11.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "11.2.4"
            },
            {
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "12.0.3"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-12-18T17:15:13.383",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7177223",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 \n\ncould allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted."
    },
    {
      "lang": "es",
      "value": "IBM Cognos Analytics 11.2.0 a 11.2.4 y 12.0.0 a 12.0.3 podría permitir a un atacante remoto realizar ataques de phishing, utilizando un ataque de redireccionamiento abierto. Al persuadir a una víctima para que visite un sitio web especialmente manipulado, un atacante remoto podría aprovechar esta vulnerabilidad para falsificar la URL mostrada y redirigir al usuario a un sitio web malicioso que parezca confiable."
    }
  ],
  "lastModified": "2026-06-17T07:53:32.773",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "792D3191-C65E-41C3-834D-45F162020756",
              "versionEndIncluding": "11.2.4",
              "versionStartIncluding": "11.2.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C1AE531-B015-421A-84A2-2F0C9E50312D",
              "versionEndIncluding": "12.0.3",
              "versionStartIncluding": "12.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}