CVE-2024-40691: IBM Cognos Controller file upload
IBM Cognos Controller 11.0.0 and 11.0.1
could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks.
Other sources
IBM Controller could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40691?
CVE-2024-40691 is considered a high severity vulnerability due to the potential for unrestricted file uploads.
How do I fix CVE-2024-40691?
To fix CVE-2024-40691, upgrade IBM Cognos Controller to versions 11.0.2 or later where the file upload validation issue is resolved.
What versions of IBM Cognos Controller are affected by CVE-2024-40691?
CVE-2024-40691 affects IBM Cognos Controller versions 11.0.0 and 11.0.1.
What type of attack can exploit CVE-2024-40691?
CVE-2024-40691 can be exploited through a malicious file upload, allowing attackers to upload executable files.
Are there any workarounds for CVE-2024-40691 before a patch is applied?
Currently, the best approach is to limit access to the web interface and monitor file uploads until a patch for CVE-2024-40691 is applied.