github - ghsa-658q-f487-r8h7

ghsa-658q-f487-r8h7

Vulnerability from github

Published

2025-02-19 18:32

Modified

2025-02-19 18:32

Severity ?

8.0 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Details

IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0

could allow an authenticated attacker to conduct formula injection. An attacker could execute arbitrary commands on the system, caused by improper validation of file contents.

Show details on source website

JSON

To clipboard

{
   affected: [],
   aliases: [
      "CVE-2024-45084",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-502",
      ],
      github_reviewed: false,
      github_reviewed_at: null,
      nvd_published_at: "2025-02-19T16:15:39Z",
      severity: "HIGH",
   },
   details: "IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 \n\ncould allow an authenticated attacker to conduct formula injection. An attacker could execute arbitrary commands on the system, caused by improper validation of file contents.",
   id: "GHSA-658q-f487-r8h7",
   modified: "2025-02-19T18:32:23Z",
   published: "2025-02-19T18:32:22Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2024-45084",
      },
      {
         type: "WEB",
         url: "https://www.ibm.com/support/pages/node/7183597",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
         type: "CVSS_V3",
      },
   ],
}

cve-2024-45084

Vulnerability from cvelistv5

Published

2025-02-19 15:24

Modified

2025-02-19 16:24

Severity ?

8.0 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Summary

IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated attacker to conduct formula injection. An attacker could execute arbitrary commands on the system, caused by improper validation of file contents.

References

▼	URL	Tags
	https://www.ibm.com/support/pages/node/7183597	vendor-advisory

Impacted products

Vendor

Product

Version

▼

IBM

Cognos Controller

Version: 11.0.0 ≤ 11.0.1

IBM

Controller

Version: 11.1.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-45084",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-19T16:24:29.148111Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-19T16:24:33.325Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               cpeApplicability: [
                  {
                     nodes: [
                        {
                           cpeMatch: [
                              {
                                 criteria: "cpe:2.3:a:ibm:cognos_controller:*:*:*:*:*:*:*:*",
                                 versionEndIncluding: "11.0.1:update_pack_3",
                                 versionStartIncluding: "11.0.0",
                                 vulnerable: true,
                              },
                           ],
                           negate: false,
                           operator: "OR",
                        },
                     ],
                  },
               ],
               defaultStatus: "unaffected",
               product: "Cognos Controller",
               vendor: "IBM",
               versions: [
                  {
                     changes: [
                        {
                           at: "FP3",
                           status: "affected",
                        },
                     ],
                     lessThanOrEqual: "11.0.1",
                     status: "affected",
                     version: "11.0.0",
                     versionType: "semver",
                  },
               ],
            },
            {
               cpeApplicability: [
                  {
                     nodes: [
                        {
                           cpeMatch: [
                              {
                                 criteria: "cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*",
                                 vulnerable: true,
                              },
                           ],
                           negate: false,
                           operator: "OR",
                        },
                     ],
                  },
               ],
               defaultStatus: "unaffected",
               product: "Controller",
               vendor: "IBM",
               versions: [
                  {
                     status: "affected",
                     version: "11.1.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "<span style=\"background-color: rgb(255, 255, 255);\">IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 \n\n<span style=\"background-color: rgb(255, 255, 255);\">could allow an authenticated attacker to conduct formula injection. An attacker could execute arbitrary commands on the system, caused by improper validation of file contents.</span>\n\n</span>",
                  },
               ],
               value: "IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 \n\ncould allow an authenticated attacker to conduct formula injection. An attacker could execute arbitrary commands on the system, caused by improper validation of file contents.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502 Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-19T15:24:03.216Z",
            orgId: "9a959283-ebb5-44b6-b705-dcc2bbced522",
            shortName: "ibm",
         },
         references: [
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.ibm.com/support/pages/node/7183597",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         title: "IBM Cognos Controller CSV injection",
         x_generator: {
            engine: "Vulnogram 0.2.0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "9a959283-ebb5-44b6-b705-dcc2bbced522",
      assignerShortName: "ibm",
      cveId: "CVE-2024-45084",
      datePublished: "2025-02-19T15:24:03.216Z",
      dateReserved: "2024-08-21T19:11:05.063Z",
      dateUpdated: "2025-02-19T16:24:33.325Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted