IBM Cognos Analytics
Moderate fix3 remedies
cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*
Moderate fix3 remedies
- 11.2.0
- 12.0
- 12.1.0
IBM Cognos Analytics and Transformer Cross-Site Scripting Vulnerability
Vulnerability
Patched
A cross-site scripting (XSS) vulnerability has been identified in IBM Cognos Analytics versions 11.2.0, 11.2.4, 12.0, and 12.1.0, as well as in IBM Cognos Transformer versions 11.2.4, 12.0, and 12.1.0. This vulnerability allows remote attackers to inject arbitrary JavaScript into the web user interface, potentially altering functionality and leading to credential disclosure within a trusted session.
Impact
Exploitation of this vulnerability allows for cross-site scripting, where injected JavaScript is executed in the context of the user's session, potentially leading to credential theft.
Remediation
Users are advised to upgrade to IBM Cognos Analytics versions 11.2.4 Fix Pack 7, 12.0.4 Fix Pack 2, or 12.1.2. For IBM Cognos Transformer, upgrade to version 12.0, 11.2.4, or 12.1.0.
Added: May 28, 2026, 2:59 AM
Updated: May 28, 2026, 2:59 AM
Vulnerability Rating
Custom Algorithm
spread
4.5impact
3.5exploitability
6.0remediation
7.7relevance
9.1threat
0.0urgency
2.9incentive
0.0Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.