← Vulnerability feed

Vulnerability record · CVE-2024-51466 · published 20 December 2024

CVE-2024-51466: Ibm cognos analytics expression language injection vulnerability

Ibm · Cognos Analytics

IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, and/or cause the server to crash when using a specially crafted EL statement.

9.0 CVSS 3.1 Critical EPSS 0.59% · top 53.8% CWE-917 · Expression language injection
9.0CVSS 3.1 base score
0.59%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, and/or cause the server to crash when using a specially crafted EL statement.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.ibm.com/support/pages/node/7179496 PatchVendor Advisory

Track CVE-2024-51466 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2020-4561Ibm cognos analytics inclusion from untrusted sphere vulnerabilityIBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who c…EPSS 2.9%9.8CVE-2021-38945Ibm cognos analytics unrestricted file upload vulnerabilityIBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation. IBM X…EPSS 1.7%9.1CVE-2022-38708Ibm cognos analytics server-side request forgery (ssrf) vulnerabilityIBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from us…EPSS 0.43%9.1CVE-2020-4377Ibm cognos analytics xml external entity (xxe) vulnerabilityIBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could ex…EPSS 2.1%9.1CVE-2019-4178Ibm cognos analytics path traversal vulnerabilityIBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request t…EPSS 3.1%8.8CVE-2021-38886Ibm cognos analytics cross-site request forgery vulnerabilityIBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and un…EPSS 0.57%8.8CVE-2021-29756Ibm cognos analytics cross-site request forgery vulnerabilityIBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execu…EPSS 0.59%8.8CVE-2021-29679Ibm cognos analytics code injection vulnerabilityIBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled inp…EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2024-51466), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.