CVE-2024-25053
IBM Cognos Analytics improper certificate validation
MEDIUM 5.9
At a glance
- Source
- NVD
- EPSS
- EPSS 0.28 % · percentile 21 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- ibm
- NVD status
- Modified
Description
IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM Planning Analytics Data Source Connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between IBM Planning Analytics server and IBM Cognos Analytics server. IBM X-Force ID: 283364.
Weaknesses (CWE)
- CWE-295 — Improper Certificate Validation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N | ibm |
| CVSS 3.1 | MEDIUM 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N | NVD · psirt@us.ibm.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-22415
- GCVE · GCVE-0-2024-25053
CERT-FR advisories
- CERTFR-2024-AVI-0959 — Multiples vulnérabilités dans les produits NetApp · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0529 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:ibm:cognos_analytics:11.2.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.1:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.3:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.1:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.2:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| IBM · Cognos Analytics | affected 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |