CVE-2024-51466

IBM Cognos Analytics expression language injection

Description

IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, and/or cause the server to crash when using a specially crafted EL statement.

Scores

Weaknesses (CWE)

• CWE-917

European references

• ENISA EUVD · EUVD-2024-45781
• GCVE · GCVE-0-2024-51466

CERT-FR advisories

• CERTFR-2025-AVI-0370 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:* ≥ 11.2.0 < 11.2.4
• cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:* ≥ 12.0.0 < 12.0.4
• cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*
• cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack1:*:*:*:*:*:*
• cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack2:*:*:*:*:*:*
• cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack3:*:*:*:*:*:*
• cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack4:*:*:*:*:*:*
• cpe:2.3:a:ibm:cognos_analytics:12.0.4:-:*:*:*:*:*:*

Affected products

References

• https://www.ibm.com/support/pages/node/7179496

Sources