Vulnerability · Published Feb 19, 2025 · Assigned by ibm

CVE-2024-45081IBM Cognos Controller incorrect authorization

Medium 6.5

In plain English

A medium-severity incorrect authorization in Cognos Controller from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 80.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated user to modify restricted content due to incorrect authorization checks.

Affected products (as reported)

Vendor	Product	Versions
IBM	Cognos Controller	11.0.0 – through 11.0.1
IBM	Controller	11.1.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

https://www.ibm.com/support/pages/node/7183597 vendor-advisory, patch