CVE-2024-51466

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-51466
IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, and/or cause the server to crash when using a specially crafted EL statement.

9.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://www.ibm.com/support/pages/node/7179496 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack1:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack2:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack3:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack4:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:12.0.4:-:*:*:*:*:*:*
History

02 Jul 2025, 15:58

Type Values Removed Values Added
First Time Ibm
Ibm cognos Analytics
Summary
  • (es) IBM Cognos Analytics 11.2.0 a 11.2.4 FP4 y 12.0.0 a 12.0.4 es vulnerable a una vulnerabilidad de inyección de lenguaje de expresión (EL). Un atacante remoto podría aprovechar esta vulnerabilidad para exponer información confidencial, consumir recursos de memoria y/o provocar que el servidor se bloquee al utilizar una declaración EL especialmente manipulada.
References () https://www.ibm.com/support/pages/node/7179496 - () https://www.ibm.com/support/pages/node/7179496 - Patch, Vendor Advisory
CPE cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack1:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack2:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack3:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack4:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:12.0.4:-:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*

20 Dec 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-20 14:15

Updated : 2025-07-02 15:58

NVD link : CVE-2024-51466

Mitre link : CVE-2024-51466

CVE.ORG link : CVE-2024-51466

JSON object : View

Products Affected

ibm

  • cognos_analytics
CWE
CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')