CVE-2024-45676 - Vulnerability Details - OpenCVE

IBM Cognos Controller 11.0.0 and 11.0.1

could allow an authenticated user to upload insecure files, due to insufficient file type distinction.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00037.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ibm	Cognos Controller

Configuration 1 [-]

OR	cpe:2.3:a:ibm:cognos_controller:11.0.0:::::::*
	cpe:2.3:a:ibm:cognos_controller:11.0.1:::::::*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.ibm.com/support/pages/node/7177220

History

Tue, 03 Dec 2024 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 03 Dec 2024 17:30:00 +0000

Type	Values Removed	Values Added
Description		IBM Cognos Controller 11.0.0 and 11.0.1 could allow an authenticated user to upload insecure files, due to insufficient file type distinction.
Title		IBM Cognos Controller file upload
First Time appeared		Ibm Ibm cognos Controller
Weaknesses		CWE-351
CPEs		cpe:2.3:a:ibm:cognos_controller:11.0.0:::::::* cpe:2.3:a:ibm:cognos_controller:11.0.1:::::::*
Vendors & Products		Ibm Ibm cognos Controller
References		https://www.ibm.com/support/pages/node/7177220
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2024-12-03T17:08:51.441Z

Updated: 2024-12-03T17:55:03.449Z

Reserved: 2024-09-03T13:50:43.964Z

Link: CVE-2024-45676

Vulnrichment

Updated: 2024-12-03T17:49:26.392Z

NVD

Status : Analyzed

Published: 2024-12-03T18:15:14.480

Modified: 2024-12-11T03:21:10.387

Link: CVE-2024-45676

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-45676", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2024-09-03T13:50:43.964Z", "datePublished": "2024-12-03T17:08:51.441Z", "dateUpdated": "2024-12-03T17:55:03.449Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:cognos_controller:11.0.1:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Cognos Controller", "vendor": "IBM", "versions": [{"status": "affected", "version": "11.0.0, 11.0.1"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">IBM Cognos Controller 11.0.0 and 11.0.1 \n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">could allow an authenticated user to upload insecure files, due to insufficient file type distinction.</span>\n\n</span>\n\n</span>\n\n</span>\n\n</span>"}], "value": "IBM Cognos Controller 11.0.0 and 11.0.1 \n\n\n\n\n\n\n\ncould allow an authenticated user to upload insecure files, due to insufficient file type distinction."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-351", "description": "CWE-351 Insufficient Type Distinction", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2024-12-03T17:08:51.441Z"}, "references": [{"url": "https://www.ibm.com/support/pages/node/7177220"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Cognos Controller file upload", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-45676", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-03T17:49:24.107791Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-03T17:55:03.449Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-45676", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-03T17:49:24.107791Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-03T17:49:26.392Z"}}], "cna": {"title": "IBM Cognos Controller file upload", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:cognos_controller:11.0.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Cognos Controller", "versions": [{"status": "affected", "version": "11.0.0, 11.0.1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.ibm.com/support/pages/node/7177220"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM Cognos Controller 11.0.0 and 11.0.1 \n\n\n\n\n\n\n\ncould allow an authenticated user to upload insecure files, due to insufficient file type distinction.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">IBM Cognos Controller 11.0.0 and 11.0.1 \n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">could allow an authenticated user to upload insecure files, due to insufficient file type distinction.</span>\n\n</span>\n\n</span>\n\n</span>\n\n</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-351", "description": "CWE-351 Insufficient Type Distinction"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2024-12-03T17:08:51.441Z"}}}, "cveMetadata": {"cveId": "CVE-2024-45676", "state": "PUBLISHED", "dateUpdated": "2024-12-03T17:55:03.449Z", "dateReserved": "2024-09-03T13:50:43.964Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2024-12-03T17:08:51.441Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}