CVE-2024-25019: IBM Cognos Controller file upload
IBM Cognos Controller 11.0.0 and 11.0.1
could be vulnerable to malicious file upload by not validating the type of file uploaded to Journal entry attachments. Attackers can make use of this weakness and upload malicious executable files into the system that can be sent to victims for performing further attacks.
Other sources
IBM Cognos Controller could be vulnerable to malicious file upload by not validating the type of file uploaded to Journal entry attachments. Attackers can make use of this weakness and upload malicious executable files into the system that can be sent to victims for performing further attacks..
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25019?
CVE-2024-25019 is considered a high severity vulnerability due to the risk of malicious file upload.
How do I fix CVE-2024-25019?
To fix CVE-2024-25019, ensure that proper file type validation is implemented for Journal entry attachments.
What are the potential impacts of CVE-2024-25019?
The potential impacts of CVE-2024-25019 include unauthorized access and execution of malicious code on the system.
Which IBM Cognos Controller versions are affected by CVE-2024-25019?
Versions 11.0.0 and 11.0.1 of IBM Cognos Controller are affected by CVE-2024-25019.
Is there a workaround for CVE-2024-25019?
A possible workaround for CVE-2024-25019 includes restricting file upload permissions until a proper fix is applied.