CVE-2024-25035: IBM Cognos Controller Information Disclosure

CVE-2024-25035 Overview

CVE-2024-25035 affects IBM Cognos Controller versions 11.0.0 and 11.0.1. The application exposes server details that could allow a remote attacker to obtain information about the application environment. This information can support reconnaissance for further attacks against the deployment. The weakness is categorized under CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere.

Critical Impact
Unauthenticated network attackers can retrieve server environment details from IBM Cognos Controller and use them to plan subsequent attacks against the application stack.

Affected Products

IBM Cognos Controller 11.0.0
IBM Cognos Controller 11.0.1

Discovery Timeline

2024-12-03 - CVE-2024-25035 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25035

Vulnerability Analysis

IBM Cognos Controller is an enterprise financial consolidation and reporting product. In versions 11.0.0 and 11.0.1, the application returns server details in responses that are accessible over the network without authentication. An attacker can query the exposed surface and collect environment data such as software versions, framework details, or internal configuration hints.

This category of information disclosure does not directly compromise data integrity or availability. It provides reconnaissance data that lowers the effort required to identify additional vulnerabilities in the deployment. Attackers commonly chain such disclosures with version-specific exploits or misconfiguration attacks.

Root Cause

The root cause is improper handling of system information in application responses, consistent with [CWE-497]. Server-side components return metadata that should remain internal, exposing details about the runtime environment to any user that can reach the service.

Attack Vector

The attack requires network access to the Cognos Controller endpoint. No authentication and no user interaction are required. An attacker issues crafted or standard requests to affected endpoints and parses the responses to extract server information. According to the Exploit Prediction Scoring System (EPSS), the current probability of exploitation activity is 0.309%.

No verified proof-of-concept code is publicly available. Refer to the IBM Support Page for vendor technical details.

Detection Methods for CVE-2024-25035

Indicators of Compromise

Unusual volumes of anonymous HTTP or HTTPS requests to IBM Cognos Controller endpoints from single sources or scanning infrastructure.
Response payloads returning server, framework, or environment identifiers to unauthenticated clients.
Reconnaissance patterns targeting error pages, diagnostic endpoints, or version banners on Cognos Controller hosts.

Detection Strategies

Inspect web server and application logs for repeated requests to endpoints that return environment metadata.
Use web application firewall (WAF) rules to flag responses containing internal version strings or stack traces sent to external clients.
Correlate reconnaissance activity against Cognos Controller with subsequent authentication or exploitation attempts on the same host.

Monitoring Recommendations

Enable verbose access logging on Cognos Controller web tiers and forward logs to a centralized analytics platform.
Baseline normal request volumes and alert on spikes from unauthenticated sources targeting the application.
Monitor outbound response sizes and content types on Cognos endpoints for anomalies that indicate metadata leakage.

How to Mitigate CVE-2024-25035

Immediate Actions Required

Review the IBM Support advisory and apply the vendor-supplied fix for IBM Cognos Controller 11.0.0 and 11.0.1.
Restrict network access to Cognos Controller to trusted management networks and authenticated users where feasible.
Audit application responses to confirm that server, framework, and environment identifiers are not returned to unauthenticated clients.

Patch Information

IBM has published remediation guidance for CVE-2024-25035 on the IBM Support Page. Administrators running IBM Cognos Controller 11.0.0 or 11.0.1 should upgrade to the fixed version identified in the advisory.

Workarounds

Place Cognos Controller behind a reverse proxy or WAF configured to strip server headers and sanitize error responses.
Disable verbose error pages and diagnostic endpoints in production deployments to reduce exposed metadata.
Enforce network segmentation and IP allow-listing so only authorized business users and administrators can reach the application.

bash

# Example: strip server identification headers at an Nginx reverse proxy
server {
    listen 443 ssl;
    server_name cognos.example.com;

    server_tokens off;
    proxy_hide_header X-Powered-By;
    proxy_hide_header Server;

    location / {
        proxy_pass https://cognos-backend.internal;
        proxy_set_header Host $host;
    }
}