IBM Cognos Analytics CVE-2019-4178 Directory Traversal Vulnerability

Bugtraq ID:	108111
Class:	Input Validation Error
CVE:	CVE-2019-4178
Remote:	Yes
Local:	No
Published:	Apr 09 2019 12:00AM
Updated:	Apr 09 2019 12:00AM
Credit:	IBM
Vulnerable:	IBM Cognos Analytics 11.0.9.0 IBM Cognos Analytics 11.0.8.0 IBM Cognos Analytics 11.0.13.0 IBM Cognos Analytics 11.0.12.0 IBM Cognos Analytics 11.0.11.0 IBM Cognos Analytics 11.0.10.0
Not Vulnerable:	IBM Cognos Analytics 11.0.13 Fix Pack 1 IBM Cognos Analytics 11.0.12 Interim Fix 2 IBM Cognos Analytics 11.0.11 Interim Fix 2 IBM Cognos Analytics 11.0.10 Interim Fix 3 IBM Cognos Analytics 11.0.9 Interim Fix 2

IBM Cognos Analytics CVE-2019-4178 Directory Traversal Vulnerability

IBM Cognos Analytics is prone to a directory-traversal vulnerability.

An attacker can exploit this issue using directory-traversal characters ('../') to access and write arbitrary files or to execute arbitrary files.

IBM Cognos Analytics versions 11.0.8.0 through 11.0.13.0 are vulnerable.

IBM Cognos Analytics CVE-2019-4178 Directory Traversal Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM Cognos Analytics CVE-2019-4178 Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Cognos Analytics CVE-2019-4178 Directory Traversal Vulnerability

References:

• IBM Homepage (IBM)
  
• Security Bulletin: A security vulnerability has been addressed in IBM Cognos An (IBM)