CVE-2024-45084

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-45084
IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated attacker to conduct formula injection. An attacker could execute arbitrary commands on the system, caused by improper validation of file contents.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.ibm.com/support/pages/node/7183597 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:ibm:cognos_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
History

25 Jul 2025, 20:28

Type Values Removed Values Added
References () https://www.ibm.com/support/pages/node/7183597 - () https://www.ibm.com/support/pages/node/7183597 - Vendor Advisory
First Time Microsoft
Microsoft windows
Ibm
Ibm cognos Controller
Ibm controller
CPE cpe:2.3:a:ibm:cognos_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Summary
  • (es) IBM Cognos Controller 11.0.0 a 11.0.1 FP3 e IBM Controller 11.1.0 podrían permitir que un atacante autenticado realice la inyección de fórmulas. Un atacante podría ejecutar comandos arbitrarios en el sistema, provocados por una validación incorrecta del contenido de los archivos.

19 Feb 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-19 16:15

Updated : 2025-07-25 20:28

NVD link : CVE-2024-45084

Mitre link : CVE-2024-45084

CVE.ORG link : CVE-2024-45084

JSON object : View

Products Affected

ibm

  • controller
  • cognos_controller

microsoft

  • windows
CWE
CWE-502

Deserialization of Untrusted Data