CVE-2024-41739
Published: 24 January 2025
Summary
CVE-2024-41739 is a high-severity Uncontrolled Search Path Element (CWE-427) vulnerability in Ibm Cognos Dashboards On Cloud Pak For Data. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Compromise Software Dependencies and Development Tools (T1195.001); ranked at the 29.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-14 (Signed Components) and SI-7 (Software, Firmware, and Information Integrity).
Deeper analysis
CVE-2024-41739 is a vulnerability in IBM Cognos Dashboards versions 4.0.7 and 5.0.0 on Cloud Pak for Data, stemming from dependency confusion (CWE-427). This issue could allow a remote attacker to perform unauthorized actions. It has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction, and high impacts across confidentiality, integrity, and availability.
A remote attacker without privileges can exploit this over the network with low complexity, though it requires user interaction such as clicking a malicious link or opening a file. Successful exploitation enables the attacker to perform unauthorized actions, potentially compromising the affected Cognos Dashboards instance.
IBM has published a security advisory with details on the vulnerability and recommended mitigations at https://www.ibm.com/support/pages/node/7177766. Security practitioners should consult this page for patching instructions and workarounds specific to Cloud Pak for Data environments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38919
Vulnerability details
IBM Cognos Dashboards 4.0.7 and 5.0.0 on Cloud Pak for Data could allow a remote attacker to perform unauthorized actions due to dependency confusion.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Explicit dependency confusion (CWE-427) vulnerability directly enables attackers to supply malicious packages/dependencies that the application loads, mapping to compromise of software dependencies.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires verification of component authenticity prior to installation, preventing dependency confusion by ensuring malicious packages mimicking legitimate dependencies are not used.
Mandates digital signatures for software components like dependencies, enabling verification to block unsigned or malicious substitutes in dependency confusion attacks.
Enforces integrity verification of software and firmware, detecting and preventing execution of tampered or confused dependencies introduced via supply chain compromise.