Description
IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated attacker to conduct formula injection. An attacker could execute arbitrary commands on the system, caused by improper validation of file contents.
References (1)
Core 1
Core References
Vendor Advisory vendor-advisory
patch
https://www.ibm.com/support/pages/node/7183597
Scores
CVSS v3
8.0
EPSS
0.0037
EPSS Percentile
28.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-1236
Status
published
Products (2)
ibm/cognos_controller
11.0.0 - 11.0.1.4
ibm/controller
11.1.0
Published
Feb 19, 2025
Tracked Since
Feb 18, 2026