IBM Cognos Analytics path traversal

published 2025-02-28 20 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-53951

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 58%
public exploits: 0; none known

IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 is vulnerable to local file inclusion vulnerability, allowing an attacker to access sensitive files by inserting path traversal payloads inside the deficon parameter.

Patch / fix

fixed in 1 links 1

ibm cognos_analytics 11.2.4, 12.0.4

ibm.com/support/pages/node/7183676 advisory

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 20 mo ago (2025-02-28)

Exploit prediction

0.84% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

IBM Cognos Analytics

Classification

Weakness

CWE-23 Relative Path Traversal

References

ibm.com /support/pages/node/7183676
vendor-advisory, patch
github.com /MarioTesoro/vulnerability-research/tree/main/CVE-2024-56340

Sources

CVE List CVE-2024-56340
NVD CVE-2024-56340

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary