5.3med
CVE-2024-25035
IBM Cognos Controller information disclosure
Published 23 mo ago · modified 4 mo ago · JSON
CVSS
5.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 24%
Public exploits
0
none known
Summary
IBM Cognos Controller 11.0.0 and 11.0.1
exposes server details that could allow an attacker to obtain information of the application environment to conduct further attacks.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction (EPSS)
0.31% probability of exploitation in the next 30 days, higher than 24% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected products
- IBM Cognos Controller
Classification
- Weakness
- CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
References
- ibm.com /support/pages/node/7177220
Sources
- CVE List: CVE-2024-25035
- NVD: CVE-2024-25035
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.