CVE-2024-56340

Published: Feb 28, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: psirt@us.ibm.com (Secondary)

Description

IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 is vulnerable to local file inclusion vulnerability, allowing an attacker to access sensitive files by inserting path traversal payloads inside the deficon parameter.

Affected (10)

Products: Ibm: Cognos Analytics

Ibm

1 product

Cognos Analytics

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Ibm Cognos Analytics	From 11.2.0 to 11.2.4
Ibm Cognos Analytics	From 12.0.0 to 12.0.4
Ibm Cognos Analytics	Version 11.2.4
Ibm Cognos Analytics	Version 11.2.4 fixpack1
Ibm Cognos Analytics	Version 11.2.4 fixpack2
Ibm Cognos Analytics	Version 11.2.4 fixpack3
Ibm Cognos Analytics	Version 11.2.4 fixpack4
Ibm Cognos Analytics	Version 11.2.4 fixpack5
Ibm Cognos Analytics	Version 12.0.4
Ibm Cognos Analytics	Version 12.0.4 interim_fix_1

Related CWEs

CWE-23

Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (2)

https://www.ibm.com/support/pages/node/7183676

Source: psirt@us.ibm.com

PatchVendor Advisory

https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-56340

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.