Cyber Resilience

CVE-2024-25047

High

Published: 02 May 2024

Published
02 May 2024
Modified
02 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
EPSS Score 0.0006 18.1th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-25047 is a high-severity Improper Output Neutralization for Logs (CWE-117) vulnerability in Ibm Cognos Analytics. Its CVSS base score is 8.6 (High).

Operationally, ranked at the 18.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided data. This could lead to further attacks against the system. IBM X-Force ID: 282956.

CWE(s)
CWE-117

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

ibm
cognos analytics
11.2.4 · 11.2.0 — 11.2.4 · 12.0.0 — 12.0.3
netapp
oncommand insight
all versions

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AU-1 Policy and Procedures
addresses: CWE-117

Policy and procedures require sanitization and neutralization when generating audit logs to avoid injection issues.

SI-15 Information Output Filtering
addresses: CWE-117

Requiring output to conform to expected content prevents unneutralized data from reaching logs.

References