CVE-2025-33150: IBM Cognos Analytics Information Disclosure

CVE-2025-33150 Overview

CVE-2025-33150 affects IBM Cognos Analytics Certified Containers version 12.1.0. The vulnerability allows a remote unauthenticated attacker to disclose package parameter information through hidden pages accessible in the application. This flaw falls under [CWE-552] (Files or Directories Accessible to External Parties), where restricted resources remain reachable over the network without proper access controls.

The issue impacts the confidentiality of package parameter data but does not affect integrity or availability. IBM has published a support document acknowledging the flaw and providing remediation guidance.

Critical Impact
A remote unauthenticated attacker can retrieve sensitive package parameter information from IBM Cognos Analytics Certified Containers 12.1.0 by accessing hidden pages that lack proper access restrictions.

Affected Products

IBM Cognos Analytics Certified Containers 12.1.0
CPE: cpe:2.3:a:ibm:cognos_analytics_certified_containers:12.1.0
Vendor: IBM

Discovery Timeline

2025-11-10 - CVE-2025-33150 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-33150

Vulnerability Analysis

The vulnerability resides in IBM Cognos Analytics Certified Containers 12.1.0, a containerized deployment of IBM's business intelligence and analytics platform. The application exposes hidden pages that were not intended for direct user access. These pages leak package parameter information, which can include metadata used to configure and drive report packages within Cognos.

Because the attack vector is network-based and requires no authentication or user interaction, any attacker who can reach the Cognos web interface can query these pages. The information exposure is limited to confidentiality impact only.

The Exploit Prediction Scoring System (EPSS) currently rates the likelihood of exploitation as low, and no public proof-of-concept code has been released. No entry exists in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is an information disclosure weakness classified as [CWE-552]. Hidden pages within the Cognos Analytics web application remain reachable by external parties. Access controls do not sufficiently restrict who can request these pages, so their contents, including package parameter data, are returned to unauthenticated clients.

Attack Vector

An attacker sends crafted HTTP requests to the Cognos Analytics web endpoints hosting the hidden pages. Since no authentication is required, the attacker only needs network reachability to the affected container. The response discloses package parameter information that could aid reconnaissance for further attacks against reporting data or downstream systems.

The vulnerability is described in prose because no verified proof-of-concept exploit code has been published. Refer to the IBM Support Document for authoritative details.

Detection Methods for CVE-2025-33150

Indicators of Compromise

Unexpected HTTP GET requests to Cognos Analytics endpoints that reference hidden or administrative pages from unauthenticated sources.
Web server access logs showing repeated requests from a single external IP address enumerating parameter-related URLs.
Anomalous outbound data transfers from Cognos containers correlating with reconnaissance-style request patterns.

Detection Strategies

Review IBM Cognos Analytics web server access logs for requests targeting non-standard or undocumented page paths.
Correlate requests against expected user session activity to identify unauthenticated access to sensitive endpoints.
Deploy web application firewall (WAF) rules to alert on access attempts to Cognos pages that should not be publicly reachable.

Monitoring Recommendations

Enable verbose HTTP access logging on the Cognos Analytics container ingress.
Forward container and web server logs to a centralized SIEM for correlation and long-term retention.
Monitor Kubernetes network policies and ingress configurations for changes that could expose the Cognos service beyond intended networks.

How to Mitigate CVE-2025-33150

Immediate Actions Required

Apply the fix documented in the IBM Support Document for IBM Cognos Analytics Certified Containers 12.1.0.
Restrict network access to Cognos Analytics container endpoints so only authorized users and services can reach the web interface.
Audit access logs for prior unauthorized requests to hidden pages and treat any disclosed package parameter data as potentially compromised.

Patch Information

IBM has published remediation guidance in the vendor advisory. Administrators should follow the instructions in the IBM Support Document to update or reconfigure affected IBM Cognos Analytics Certified Containers 12.1.0 deployments.

Workarounds

Place the Cognos Analytics web interface behind an authenticated reverse proxy or VPN to prevent unauthenticated network access.
Implement WAF rules that block requests to the affected hidden page paths until the vendor fix is applied.
Segment the Cognos container within a restricted Kubernetes namespace with strict ingress network policies.

bash

# Example Kubernetes NetworkPolicy restricting ingress to Cognos Analytics
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-cognos-ingress
  namespace: cognos
spec:
  podSelector:
    matchLabels:
      app: cognos-analytics
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: trusted-clients
      ports:
        - protocol: TCP
          port: 9300