{"id":"CVE-2024-52902","state":"PUBLISHED","title":"IBM Cognos Controller information disclosure","description":"IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could be used for unauthorized access to the system.","publishedAt":"2025-02-19T14:50:24.376Z","updatedAt":"2025-08-15T14:42:21.022Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"ibm"},"assigner":"ibm","products":["IBM Cognos Controller","IBM Controller"],"affected":[{"vendor":"IBM","product":"Cognos Controller","defaultStatus":"unaffected","versions":[{"version":"11.0.0","status":"affected","lessThanOrEqual":"11.0.1","changes":[{"at":"FP3","status":"unaffected"}],"versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:cognos_controller:11.0.1:fix_pack_3:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Controller","defaultStatus":"unaffected","versions":[{"version":"11.1.0","status":"affected"}]}],"references":["https://www.ibm.com/support/pages/node/7183597"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T20:08:04.920Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/52xxx/CVE-2024-52902.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-52902","state":"PUBLISHED","datePublished":"2025-02-19T14:50:24.376Z","dateUpdated":"2025-08-15T14:42:21.022Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2024-11-17T14:25:57.179Z"},"containers":{"cna":{"title":"IBM Cognos Controller information disclosure","descriptions":[{"lang":"en","value":"IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could be used for unauthorized access to the system."}],"affected":[{"vendor":"IBM","product":"Cognos Controller","defaultStatus":"unaffected","versions":[{"version":"11.0.0","status":"affected","lessThanOrEqual":"11.0.1","changes":[{"at":"FP3","status":"unaffected"}],"versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:cognos_controller:11.0.1:fix_pack_3:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Controller","defaultStatus":"unaffected","versions":[{"version":"11.1.0","status":"affected"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7183597","tags":["vendor-advisory","patch"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","description":"CWE-798 Use of Hard-coded Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2025-08-15T14:42:21.022Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-19T15:25:58.534638Z","id":"CVE-2024-52902","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-19T15:26:06.517Z"}}]}}}