CVE-2021-29679 Code injection in Cognos Analytics
Authenticated attackers can execute remote code via server-side include injection in IBM Cognos Analytics.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-29679?
CVE-2021-29679 is a high-severity code injection vulnerability in Ibm Cognos Analytics, published on 15 Oct 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that could be interpreted a a server-side include (SSI) directive. IBM X-Force ID: 199915.
Weakness: CWE-94
Which versions are affected by CVE-2021-29679?
It affects 2 products.
Products include Ibm Cognos Analytics, Netapp Oncommand Insight.
How do I fix CVE-2021-29679?
No fix has been published for CVE-2021-29679 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-29679 being exploited?
There is no known exploitation of CVE-2021-29679 in the wild and no public exploit code.
Other vulnerabilities in Ibm Cognos Analytics
- CVE-2020-4561 Missing authorization in Cognos Analytics
- CVE-2024-51466 IBM Cognos Analytics expression language injection
- CVE-2024-25047 IBM Cognos Analytics log injection
- CVE-2018-1721 IBM Cognos Analytics 11.0 and 11.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data.
- CVE-2020-4300 XML external entity in Cognos Analytics
Sources
Also known as GHSA-7299-r4w8-x368.