CVE-2024-41739
Published: 24 January 2025
Summary
CVE-2024-41739 is a high-severity Uncontrolled Search Path Element (CWE-427) vulnerability in Ibm Cognos Dashboards On Cloud Pak For Data. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 49.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-14 (Signed Components) and SI-7 (Software, Firmware, and Information Integrity).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires verification of component authenticity prior to installation, preventing dependency confusion by ensuring malicious packages mimicking legitimate dependencies are not used.
Mandates digital signatures for software components like dependencies, enabling verification to block unsigned or malicious substitutes in dependency confusion attacks.
Enforces integrity verification of software and firmware, detecting and preventing execution of tampered or confused dependencies introduced via supply chain compromise.
NVD Description
IBM Cognos Dashboards 4.0.7 and 5.0.0 on Cloud Pak for Data could allow a remote attacker to perform unauthorized actions due to dependency confusion.
Deeper analysisAI
CVE-2024-41739 is a vulnerability in IBM Cognos Dashboards versions 4.0.7 and 5.0.0 on Cloud Pak for Data, stemming from dependency confusion (CWE-427). This issue could allow a remote attacker to perform unauthorized actions. It has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction, and high impacts across confidentiality, integrity, and availability.
A remote attacker without privileges can exploit this over the network with low complexity, though it requires user interaction such as clicking a malicious link or opening a file. Successful exploitation enables the attacker to perform unauthorized actions, potentially compromising the affected Cognos Dashboards instance.
IBM has published a security advisory with details on the vulnerability and recommended mitigations at https://www.ibm.com/support/pages/node/7177766. Security practitioners should consult this page for patching instructions and workarounds specific to Cloud Pak for Data environments.
Details
- CWE(s)