IBM Cognos Controller and IBM Controller Unrestricted Deserialization Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing unrestricted deserialization has been identified in IBM Cognos Controller versions 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0. This vulnerability enables users to execute arbitrary code, escalate privileges, or cause denial-of-service attacks by exploiting the unrestricted deserialization of types within the application.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution, unauthorized privilege escalation, or denial-of-service conditions.

Remediation

Users are advised to upgrade to IBM Cognos Controller 11.0.1 FP4 or IBM Controller 11.1.0.1. Instructions for downloading these versions are available on the IBM Support website.