CVE-2025-36126
IBM Cognos Analytics is affected by Cross-site scripting.
En bref Sévérité MEDIUM 6.4 EPSS EPSS 0.18 % · centile 8 (2026-10-27) État PUBLISHED Publiée 2026-05-26 Mise à jour 2026-05-27 Attribuée par ibm Statut NVD Analyzed Description IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos Adminstration. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N ibm CVSS 3.1 MEDIUM 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N NVD · psirt@us.ibm.com (Secondary) CVSS 3.1 HIGH 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.2cpe:2.3:a:ibm:cognos_analytics:11.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.1:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.3:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:-:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack1:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack2:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack3:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack4:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack5:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:fixpack6:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:interim_fix_1:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:interim_fix_2:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:interim_fix_3:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:interim_fix_4:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:11.2.4:interim_fix_5:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.1:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.3:-:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.3:interim_fix_1:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.3:interim_fix_2:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.4:-:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.4:fixpack1:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.4:interim_fix_1:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.4:interim_fix_2:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_analytics:12.0.4:interim_fix_3:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_transformer:11.2.4:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_transformer:12.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:cognos_transformer:12.1.0:*:*:*:*:*:*:*Produits affectés
Références
Sources
