Skip to content
OpenAdvisories
High NCSC-2025-0064 18 CVEs

Kwetsbaarheden verholpen in IBM Cognos Controller

Published Feb 21, 2025 · Updated Feb 21, 2025 · nl

Vendor: IBM Product: Cognos Controller

Summary

IBM heeft kwetsbaarheden verholpen in IBM Cognos Controller (Versies 11.0.0 tot 11.0.1 FP3 en 11.1.0).

Details

Interpretaties
De kwetsbaarheden stellen een kwaadwillende in staat om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:

- Denial-of-Service (DoS)
- Cross-Site-Scripting (XSS)
- Omzeilen van een beveiligingsmaatregel
- Manipulatie van gegevens
- Verkrijgen van verhoogde rechten
- Uitvoer van willekeurige code (Gebruikersrechten)
- Toegang tot gevoelige informatie

De kwetsbaarheden bevinden zich zowel in de Cognos Controller-Applicatie zelf, als in onderliggende producten, zoals Java, Websphere Liberty, Apache Ant en diverse Open Source componenten, welke met Cognos Controller worden meegeleverd.

Oplossingen
IBM heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 18

  • Critical 10.0
    CVE-2024-38999

    jrburke requirejs vulnerable to prototype pollution

    jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

    py3.13-jupyterhub py3.12-jupyterhub py3.11-jupyterhub py3.10-jupyterhub Debian Ubuntu Wolfi npm
  • High 8.8
    CVE-2024-28777

    IBM Cognos Controller code execution

    IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to unrestricted deserialization. This vulnerability allows users to execute arbitrary code, escalate privileges, or cause denial of service attacks by exploiting the unres…

    IBM Cognos Controller Controller
  • High 8.8
    CVE-2024-52902

    IBM Cognos Controller information disclosure

    IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could be used for unauthorized access to the system.

    IBM Cognos Controller Controller
  • High 8.2
    CVE-2023-47160

    IBM Cognos Controller XML external entity injection

    IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume me…

    IBM Cognos Controller Controller
  • High 8.0
    CVE-2024-45084

    IBM Cognos Controller CSV injection

    IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated attacker to conduct formula injection. An attacker could execute arbitrary commands on the system, caused by improper validation of file contents.

    IBM Cognos Controller Controller
  • High 7.5
    CVE-2020-11979

    Code injection in Apache Ant

    As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said prot…

    ant ant gradle apache-ant Debian Ubuntu Alpine Maven
  • High 7.5
    CVE-2022-4244 Public exploit

    Codehaus-plexus: directory traversal

    A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by u…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Maven
  • Medium 6.5
    CVE-2024-45081

    IBM Cognos Controller incorrect authorization

    IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated user to modify restricted content due to incorrect authorization checks.

    IBM Cognos Controller Controller
  • Medium 5.9
    CVE-2024-27267

    IBM SDK, Java Technology Edition denial of service

    The Object Request Broker (ORB) in IBM SDK, Java Technology Edition 7.1.0.0 through 7.1.5.18 and 8.0.0.0 through 8.0.8.26 is vulnerable to remote denial of service, caused by a race condition in the management of ORB listener threads.

    IBM SDK, Java Technology Edition
  • Medium 5.9
    CVE-2024-28780

    IBM Cognos Controller information disclosure

    IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 Rich Client  uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

    IBM Cognos Controller Controller
  • Medium 5.5
    CVE-2021-36373

    Apache Ant TAR archive denial of service vulnerability

    When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.…

    Apache Software Foundation Apache Ant javapackages-bootstrap ant Debian Ubuntu Azure Linux Alpine Maven
  • Medium 5.5
    CVE-2021-36374

    Apache Ant ZIP, and ZIP based, archive denial of service vulerability

    When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly …

    Apache Software Foundation Apache Ant javapackages-bootstrap ant Debian Ubuntu Azure Linux Alpine Maven
  • Medium 5.4
    CVE-2024-28776

    IBM Cognos Controller cross-site scripting

    IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to c…

    IBM Cognos Controller Controller
  • Medium 5.3
    CVE-2023-50314

    IBM WebSphere Application Server Libery information disclosure

    IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.8 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensiti…

    IBM WebSphere Application Liberty
  • Medium 4.8
    CVE-2024-21145

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

    Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi
  • Medium 4.3
    CVE-2022-4245

    Codehaus-plexus: xml external entity (xxe) injection

    A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Maven
  • Low 3.7
    CVE-2024-21131

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

    Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi
  • Low 3.7
    CVE-2024-21144

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrenc…

    Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi

Revision history

  1. #0

    Initiele versie

References