← Back

CVE-2025-0823

nvd nist
Published: Feb 28, 2025Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: psirt@us.ibm.com (Secondary)

Description

IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 and 12.0.0 through 12.0.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Affected (10)

Ibm
1 product
Cognos Analytics
Configuration A
10 vulnerable
Vulnerable SoftwareAffected Versions
Ibm
Cognos Analytics
11.2.0 ≤ version < 11.2.4
Cognos Analytics
12.0.0 ≤ version < 12.0.4
Cognos Analytics
Version 11.2.4
Cognos Analytics
Version 11.2.4 fixpack1
Cognos Analytics
Version 11.2.4 fixpack2
Cognos Analytics
Version 11.2.4 fixpack3
Cognos Analytics
Version 11.2.4 fixpack4
Cognos Analytics
Version 11.2.4 fixpack5
Cognos Analytics
Version 12.0.4
Cognos Analytics
Version 12.0.4 interim_fix_1

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (1)

Source: psirt@us.ibm.com
PatchVendor Advisory

Timeline

No history available yet.