IBM Cognos Analytics versions 11.2.0 through 12.2.4 Fix Pack 5 and 12.0.0 through 12.0.4 are vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI, potentially altering functionality and leading to credential disclosure within a trusted session.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.4 | CVE-2024-52900 |
Exploitation
To exploit this vulnerability, an authenticated user can input arbitrary JavaScript code into the Web UI of IBM Cognos Analytics. This code can then be executed in the context of other users’ sessions, potentially leading to unauthorized access to sensitive information.
Affected Products
- IBM Cognos Analytics 11.2.0 – Vulnerable to XSS allowing JavaScript injection.
- IBM Cognos Analytics 12.0.0 – Vulnerable to XSS allowing JavaScript injection.
- IBM Cognos Analytics 12.2.4 Fix Pack 5 – Vulnerable to XSS allowing JavaScript injection.
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest version of IBM Cognos Analytics that addresses this issue. Additionally, implementing input validation and sanitization can help prevent the injection of malicious scripts.