IBM Cognos Analytics Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in IBM Cognos Analytics versions 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4. This vulnerability allows a privileged user to inject arbitrary JavaScript into the Web UI, potentially altering functionality and leading to credential disclosure within a trusted session.

Impact

Exploitation of this vulnerability could result in stored cross-site scripting, allowing injected JavaScript to be executed in the context of the user.

Remediation

Users of IBM Cognos Analytics versions 12.0.0 to 12.0.4 can upgrade to 12.0.4 Fix Pack 1. Those on versions 11.2.0 to 11.2.4 IF3 should upgrade to 11.2.4 IF4. Instructions for downloading these versions are available on the IBM Support website.