Improper Output Neutralization for Logs (CWE-117)
IBM Cognos Analytics versions 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 are vulnerable to injection attacks in application logging due to lack of sanitization of user provided data. This could allow an attacker to conduct further attacks against the system.
An attacker could potentially inject malicious code into the application logs, enabling further compromise of the system. This could lead to data theft, system misuse, or other malicious actions depending on the level of access gained.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Based on the information provided, there does not appear to be an explicit mention of a patch being available. However, upgrading to a newer version of IBM Cognos Analytics that addresses this vulnerability would mitigate the risk.
Mitigations should include applying the latest security updates from IBM for Cognos Analytics. Additionally, restrict access to the logging functionality, monitor logs for any suspicious entries, and follow secure coding practices to properly sanitize all user input.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Feedly found the first article mentioning CVE-2024-25047. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-25047
A CVSS base score of 8.6 has been assigned.
EPSS Score was set to: 0.04% (Percentile: 8.2%)