CVE-2024-49352
IBM Cognos Anaytics XML external entity injection
En bref Sévérité HIGH 7.1 EPSS EPSS 0.48 % · centile 41 (2026-10-28) État PUBLISHED Publiée 2025-02-05 Mise à jour 2025-02-22 Attribuée par ibm Statut NVD Analyzed Description IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Scores Version Score Vecteur Évalué par CVSS 3.1 HIGH 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L ibm CVSS 3.1 HIGH 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L NVD · psirt@us.ibm.com (Secondary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:* ≥ 11.2.0 < 11.2.4cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:* ≥ 12.0.0 < 12.0.4cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack1:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack2:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack3:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack4:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.4:-:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.4:interim_fix_1:*:*:*:*:*:*Produits affectés Produit Versions IBM · Cognos Analytics affected 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4
Références
Sources
