CVE-2024-25053: IBM Cognos Analytics improper certificate validation

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-28 · updated 2026-06-17
Weakness: CWE-295

Description

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM Planning Analytics Data Source Connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between IBM Planning Analytics server and IBM Cognos Analytics server. IBM X-Force ID: 283364.

Affected products

IBM Cognos Analytics: 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0 (+2)

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/283364
https://www.ibm.com/support/pages/node/7156941
https://exchange.xforce.ibmcloud.com/vulnerabilities/283364
https://security.netapp.com/advisory/ntap-20241108-0002/
https://www.ibm.com/support/pages/node/7156941

Get alerted when CVE-2024-25053 or the next vulnerability affects your stack