CVE-2024-25042

CVSS 3.1 Score 6.1 of 10 (medium)

Details

Published Dec 18, 2024
Updated: Jan 10, 2025
CWE ID 79

Summary

CVE-2024-25042 is a Cross-Site Scripting (XSS) vulnerability affecting IBM Cognos Analytics versions 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3. This issue arises due to insufficient validation of column headings in Cognos Explorations. A remote attacker can exploit this vulnerability by injecting malicious scripts, potentially gaining unauthorized access to user sessions or stealing sensitive information. IBM strongly recommends updating to the latest version or applying the appropriate patches to mitigate this risk.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • IBM Cognos Analytics

Affected Vendors

  • IBM Corporation

Advisories, Assessments, and Mitigations