CVE-2024-25047
published 2024-05-02CVE-2024-25047: IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided…
PriorityP344high8.6CVSS 3.1
AVNACLPRNUINSCCNIHAN
EPSS
0.64%
46.7th percentile
IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided data. This could lead to further attacks against the system. IBM X-Force ID: 282956.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | cognos_analytics | — | — |
| ibm | cognos_analytics | — | — |
| ibm | cognos_analytics | >= 11.2.0 < 11.2.4 | 11.2.4 |
| ibm | cognos_analytics | >= 12.0.0 < 12.0.3 | 12.0.3 |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
osv5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
smarty3 vulnerabilities
osv·2024-12-12·CVSS 5.4
CVE-2018-25047 smarty3 vulnerabilities
smarty3 vulnerabilities
It was discovered that Smarty incorrectly handled query parameters in
requests. An attacker could possibly use this issue to inject arbitrary
Javascript code, resulting in denial of service or potential execution of
arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04
LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2018-25047, CVE-2023-28447)
It was discovered that Smarty did not properly sanitize user input when
generating templates. An attacker could, through PHP injection, possibly
use this issue to execute arbitrary code. (CVE-2024-35226)
GHSA
GHSA-6r52-jcm4-48gv: IBM Cognos Analytics 11
ghsa_unreviewed·2024-05-02
CVE-2024-25047 [HIGH] CWE-117 GHSA-6r52-jcm4-48gv: IBM Cognos Analytics 11
IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided data. This could lead to further attacks against the system. IBM X-Force ID: 282956.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://exchange.xforce.ibmcloud.com/vulnerabilities/282956https://security.netapp.com/advisory/ntap-20240621-0007/https://www.ibm.com/support/pages/node/7149874https://exchange.xforce.ibmcloud.com/vulnerabilities/282956https://security.netapp.com/advisory/ntap-20240621-0007/https://www.ibm.com/support/pages/node/7149874
2024-05-02
Published