CVE-2024-28778 IBM Cognos Controller information disclosure

Medium 6.5 Published 7 Jan 2025 Updated 7 Jan 2025

Attackers can access exposed Artifactory API keys to publish code to private repositories, compromising supply chain integrity.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-28778?

CVE-2024-28778 is a medium-severity vulnerability in Ibm Cognos Controller, published on 7 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 is vulnerable to exposure of Artifactory API keys. This vulnerability allows users to publish code to private packages or repositories under the name of the organization.

Weakness: CWE-798

Which versions are affected by CVE-2024-28778?

It affects 2 products.

Products include Ibm Cognos Controller, Ibm Controller.

How do I fix CVE-2024-28778?

No fix has been published for CVE-2024-28778 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-28778 being exploited?

There is no known exploitation of CVE-2024-28778 in the wild and no public exploit code.

All Ibm Cognos Controller vulnerabilities

Sources

Also known as GHSA-6hqr-x7j2-4jmh.