CVE-2017-1535: XSS

Published Aug 29, 2017

Updated

IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130677.

Affected Software

7 affected components

IBM Cognos Analytics=11.0.0

IBM Cognos Analytics=11.0.1

IBM Cognos Analytics=11.0.2

IBM Cognos Analytics=11.0.3

IBM Cognos Analytics=11.0.4

IBM Cognos Analytics=11.0.5

IBM Cognos Analytics=11.0.6

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg22007242

Event History

Aug 29, 2017

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-1535?

The severity of CVE-2017-1535 is classified as critical due to the potential for cross-site scripting attacks.

How do I fix CVE-2017-1535?

To fix CVE-2017-1535, users should upgrade to a patched version of IBM Cognos Analytics beyond 11.0.6.

What is the impact of CVE-2017-1535?

CVE-2017-1535 can lead to credentials disclosure and manipulation of the intended functionality within the Web UI.

Is my IBM Cognos Analytics version affected by CVE-2017-1535?

IBM Cognos Analytics versions 11.0.0 through 11.0.6 are affected by CVE-2017-1535.

Who discovered CVE-2017-1535?

CVE-2017-1535 was discovered by researchers and reported to IBM X-Force.