← Vulnerability feed

Vulnerability record · CVE-2020-4377 · published 3 August 2020

CVE-2020-4377: Ibm cognos analytics xml external entity (xxe) vulnerability

Ibm · Cognos Analytics

IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 179156.

9.1 CVSS 3.1 Critical EPSS 2.1% · top 19.3% CWE-611 · XML external entity (XXE)
9.1CVSS 3.1 base score, v2 6.4
2.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 179156.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://exchange.xforce.ibmcloud.com/vulnerabilities/179156 VDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6252853 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/179156 VDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6252853 Vendor Advisory

Track CVE-2020-4377 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2020-4561Ibm cognos analytics inclusion from untrusted sphere vulnerabilityIBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who c…EPSS 2.9%9.8CVE-2021-38945Ibm cognos analytics unrestricted file upload vulnerabilityIBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation. IBM X…EPSS 1.7%9.1CVE-2022-38708Ibm cognos analytics server-side request forgery (ssrf) vulnerabilityIBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from us…EPSS 0.43%9.1CVE-2019-4178Ibm cognos analytics path traversal vulnerabilityIBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request t…EPSS 3.1%9.0CVE-2024-51466Ibm cognos analytics expression language injection vulnerabilityIBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remo…EPSS 0.59%8.8CVE-2021-38886Ibm cognos analytics cross-site request forgery vulnerabilityIBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and un…EPSS 0.57%8.8CVE-2021-29756Ibm cognos analytics cross-site request forgery vulnerabilityIBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execu…EPSS 0.59%8.8CVE-2021-29679Ibm cognos analytics code injection vulnerabilityIBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled inp…EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2020-4377), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.