CVE-2024-52900
IBM Cognos Analytics cross-site scripting
En bref Sévérité MEDIUM 6.4 EPSS EPSS 0.20 % · centile 10 (2026-10-27) État PUBLISHED Publiée 2025-06-28 Mise à jour 2025-08-24 Attribuée par ibm Statut NVD Analyzed Description IBM Cognos Analytics 11.2.0 through 12.2.4 Fix Pack 5 and 12.0.0 through 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N ibm CVSS 3.1 MEDIUM 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N NVD · psirt@us.ibm.com (Secondary) CVSS 3.1 MEDIUM 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:* ≥ 11.2.0 < 11.2.4cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:* ≥ 12.0.0 < 12.0.4cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack1:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack2:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack3:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack4:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack5:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:interim_fix_1:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:interim_fix_2:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:interim_fix_3:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:interim_fix_4:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:interim_fix_5:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.4:-:*:*:*:*:*:*Produits affectés
Références
Sources
