CVE-2024-52902

CWE-798 — Hard-coded Credentials3 documents3 sources
Severity
8.8HIGH
EPSS
0.1%
top 70.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Cognos ControllerIBM Controller
Timeline
PublishedFeb 19

Description

IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could be used for unauthorized access to the system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶NVDibm/cognos_controller11.0.0 — 11.0.1.4
▶CVEListV5ibm/cognos_controller11.0.0 — 11.0.1
▶CVEListV5ibm/controller11.1.0
▶NVDibm/controller11.1.0

🔴Vulnerability Details

2
GHSA
GHSA-7rr8-j367-crh2: IBM Cognos Controller 11↗2025-02-19
▶
CVEList
IBM Cognos Controller information disclosure↗2025-02-19
▶
CVE-2024-52902 (HIGH CVSS 8.8) | IBM Cognos Controller 11.0.0 throug | cvebase.io