CVE-2024-40691 HIGH

CVE-2024-40691: IBM Cognos Controller file upload

Vendor Ibm

Product Cognos Controller

Weakness CWE-434 · Unrestricted file upload

Published December 3, 2024

Last update December 3, 2024

View on NVD All CVEs

CVSS base score

8.0/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

IBM Cognos Controller 11.0.0 and 11.0.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks.

Key dates

02Disclosure timeline

December 3, 2024 CVE published

December 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-40691 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2024-58349 WordPress Theme Travelscape 1.0.3 Arbitrary File Upload CVE-2026-11474 Kushan2k student-management-system Registration Endpoint RegisterService.php unrestricted upload CVE-2026-40772 WordPress GeekyBot plugin <= 1.2.2 - Arbitrary File Upload vulnerability CVE-2026-33560 Daktronics Controller Firmware Unrestricted Upload of File with Dangerous Type CVE-2026-48945 Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26