Description
IBM Cognos Analytics 11.2.0, 11.2.4, 12.0, and 12.1.0 and IBM Cognos Transformer 11.2.4, 12.0, and 12.1.0 are vulnerable to cross-site scripting (XSS). This vulnerability allows a remote attacker to inject arbitrary JavaScript code into the web user interface, which may alter the intended functionality and could lead to the disclosure of credentials within a trusted session.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| IBM | Cognos Analytics | 11.2.0, 12.0, 12.1.0 | — |
| IBM | Cognos Transformer | 12.0, 11.2.4, 12.1.0 | — |
References
- https://www.ibm.com/support/pages/node/7272628 vendor-advisory patch