Description

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the malicious JavaScript code is executed. This could result in the cookies from the administrator being compromised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-14T21:17:25.983Z",
  "pubdate": "2026-09-14T21:17:25.983Z",
  "executiveSummary": "A Stored Cross-Site Scripting (XSS) vulnerability exists within IBM Cognos Analytics, specifically affecting versions 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2.\nThe vulnerability allows a non-privileged user to inject malicious JavaScript code into account profile fields, namely the given name and surname.\nThis payload is persisted in the application backend and triggered when an administrator views the affected user's permissions within the management panel.\nThe primary impact is the unauthorized execution of script code within the administrative context, leading to session hijacking via cookie exfiltration.\nThe attack requires a registered user account with the ability to modify profile information, making this a medium-to-high risk flaw given the potential for privilege escalation and administrative compromise.\nNo complex network conditions are required, as the vulnerability resides in the application's input handling and output rendering logic.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the IBM Cognos Analytics application to perform adequate input validation and output encoding on user-supplied profile fields, specifically the 'given name' and 'surname' attributes.\nBy submitting crafted JavaScript payloads into these fields, an attacker can store malicious scripts in the application's database.\nThe attack flow follows a persistent injection pattern: First, a non-privileged user authenticates to the IBM Cognos environment and navigates to the profile management interface.\nSecond, the user modifies the given name or surname fields, inserting a malicious script tag (e.g., <script>...</script>) as part of the string.\nThe application processes these fields without sanitizing the input or stripping HTML tags, persisting the payload to the underlying database.\nThird, the stored payload remains dormant until an administrator accesses the 'user account management' panel to audit or view permissions for that specific user.\nWhen the administrator's browser renders the page containing the malicious user profile, the browser interprets the stored script as legitimate code originating from the trusted application origin.\nThe script executes within the security context of the administrator's active session. Because the script runs in the administrative domain, it gains access to sensitive data, specifically the administrator's session cookies.\nThe payload can be designed to exfiltrate these cookies to an attacker-controlled external server via an asynchronous HTTP request (e.g., using XMLHttpRequest or the fetch API).\nOnce the attacker possesses the administrative session identifier, they can perform session hijacking, potentially gaining full unauthorized access to the IBM Cognos Analytics instance, including the ability to modify configurations, access reports, or escalate privileges.\nThe vulnerability affects IBM Cognos Analytics 12.1.0 through 12.1.3 FP1 and 12.0.4 through 12.0.4 FP2. The flaw is platform-independent but requires the user to have valid authentication to the application to initiate the injection process.\nThe lack of context-aware output encoding when rendering user-generated content in the administrative dashboard is the critical failure point that enables the XSS execution."
}