CVE-2021-38946: XSS

Published Apr 22, 2022

Updated

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 211240.

Other sources

IBM Cognos Analytics is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Software

4 affected components

IBM Cognos Analytics=11.1.7

IBM Cognos Analytics=11.2.0

IBM Cognos Analytics=11.2.1

NetApp OnCommand Insight

Remediation

Patch Available

https://www.ibm.com/support/pages/node/6570957

Event History

Apr 22, 2022

CVE Published

via MITRE·04:30 PM

Data Sourced

via MITRE·04:30 PM

DescriptionSeverityWeakness

Aug 3, 2024

Data Sourced

via IBM·05:47 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-6570957

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2021-38946.

What is the severity of CVE-2021-38946?

The severity of CVE-2021-38946 is medium with a CVSS score of 5.4.

How does CVE-2021-38946 affect IBM Cognos Analytics?

CVE-2021-38946 affects IBM Cognos Analytics by allowing users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

How can I fix the cross-site scripting vulnerability in IBM Cognos Analytics?

To fix the cross-site scripting vulnerability in IBM Cognos Analytics, apply the necessary patches or updates provided by IBM.

Where can I find more information about CVE-2021-38946?

You can find more information about CVE-2021-38946 at https://exchange.xforce.ibmcloud.com/vulnerabilities/211240.