IBM Cognos Analytics up to 11.2.4 FP4/12.0.4 EL Handler expression language injection

Summaryinfo

A vulnerability described as critical has been identified in IBM Cognos Analytics up to 11.2.4 FP4/12.0.4. This issue affects some unknown processing of the component EL Handler. Executing a manipulation can lead to expression language injection. The identification of this vulnerability is CVE-2024-51466. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in IBM Cognos Analytics up to 11.2.4 FP4/12.0.4 and classified as critical. This vulnerability affects an unknown code block of the component EL Handler. The manipulation with an unknown input leads to a expression language injection vulnerability. The CWE definition for the vulnerability is CWE-917. The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, and/or cause the server to crash when using a specially crafted EL statement.

The advisory is shared for download at ibm.com. This vulnerability was named CVE-2024-51466 since 10/28/2024. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/02/2025).

The vulnerability scanner Nessus provides a plugin with the ID 213474 (IBM Cognos Analytics 11.2.x < 11.2.4 FP5 / 12.0.x < 12.0.4 IF1 Multiple Vulnerabilities (7179496)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (213474). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Business Process Management Software

Vendor

• IBM

Name

• Cognos Analytics

Version

• 11.2.4 FP4
• 12.0.0
• 12.0.1
• 12.0.2
• 12.0.3
• 12.0.4

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion