← Vulnerability feed

Vulnerability record · CVE-2019-4178 · published 15 April 2019

CVE-2019-4178: Ibm cognos analytics path traversal vulnerability

Ibm · Cognos Analytics

IBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to write or view arbitrary files on the system. IBM X-Force ID: 158919.

9.1 CVSS 3.0 Critical EPSS 3.1% · top 12.9% CWE-22 · Path traversal
9.1CVSS 3.0 base score, v2 6.4
3.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

IBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to write or view arbitrary files on the system. IBM X-Force ID: 158919.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.ibm.com/support/docview.wss?uid=ibm10879079 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/158919 VDB EntryVendor Advisory
https://security.netapp.com/advisory/ntap-20190509-0004/
http://www.ibm.com/support/docview.wss?uid=ibm10879079 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/158919 VDB EntryVendor Advisory
https://security.netapp.com/advisory/ntap-20190509-0004/

Track CVE-2019-4178 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2020-4561Ibm cognos analytics inclusion from untrusted sphere vulnerabilityIBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who c…EPSS 2.9%9.8CVE-2021-38945Ibm cognos analytics unrestricted file upload vulnerabilityIBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation. IBM X…EPSS 1.7%9.1CVE-2022-38708Ibm cognos analytics server-side request forgery (ssrf) vulnerabilityIBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from us…EPSS 0.43%9.1CVE-2020-4377Ibm cognos analytics xml external entity (xxe) vulnerabilityIBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could ex…EPSS 2.1%9.0CVE-2024-51466Ibm cognos analytics expression language injection vulnerabilityIBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remo…EPSS 0.59%8.8CVE-2021-38886Ibm cognos analytics cross-site request forgery vulnerabilityIBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and un…EPSS 0.57%8.8CVE-2021-29756Ibm cognos analytics cross-site request forgery vulnerabilityIBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execu…EPSS 0.59%8.8CVE-2021-29679Ibm cognos analytics code injection vulnerabilityIBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled inp…EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2019-4178), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.