← Back

CVE-2024-51466

nvd nist
Published: Dec 20, 2024Modified: Jun 17, 2026

JSON object

Loading...
9.0
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitability: 2.2 / Impact: 6.0
Source: psirt@us.ibm.com (Secondary)

Description

IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, and/or cause the server to crash when using a specially crafted EL statement.

Affected (8)

Ibm
1 product
Cognos Analytics
Configuration A
8 vulnerable
Vulnerable SoftwareAffected Versions
Ibm
Cognos Analytics
From 11.2.0 to 11.2.4
Cognos Analytics
From 12.0.0 to 12.0.4
Cognos Analytics
Version 11.2.4
Cognos Analytics
Version 11.2.4 fixpack1
Cognos Analytics
Version 11.2.4 fixpack2
Cognos Analytics
Version 11.2.4 fixpack3
Cognos Analytics
Version 11.2.4 fixpack4
Cognos Analytics
Version 12.0.4

Related CWEs

CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

References (1)

Source: psirt@us.ibm.com
PatchVendor Advisory

Timeline

No history available yet.