Arbitrary file upload in IBM Cognos Analytics - CVE-2024-40695
Published: May 1, 2025
Vulnerability identifier: #VU108096
CSH Severity: High
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-40695
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to application does not validate the content of the file uploaded to the web interface. A remote user can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks.
Affected software
IBM Cognos Analytics
How to mitigate CVE-2024-40695
Install updates from vendor's website.
IBM Cognos Analytics - addressed in versions 11.2.4 FP5, 12.0.4 IF1