CVE-2019-4139: XSS

Published May 29, 2019

Updated

IBM Cognos Analytics 11.0, 11.1.0, and 11.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158335.

Affected Software

3 affected components

IBM Cognos Analytics=11.0.0

IBM Cognos Analytics=11.1.0

IBM Cognos Analytics=11.1.1

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=ibm10883872

Event History

May 29, 2019

CVE Published

via MITRE·03:10 PM

Data Sourced

via MITRE·03:10 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2019-4139?

CVE-2019-4139 is classified as a high-severity vulnerability due to its potential for cross-site scripting and credential disclosure.

How do I fix CVE-2019-4139?

To resolve CVE-2019-4139, upgrade IBM Cognos Analytics to the latest version that includes security patches.

What versions of IBM Cognos Analytics are affected by CVE-2019-4139?

CVE-2019-4139 affects IBM Cognos Analytics versions 11.0.0, 11.1.0, and 11.1.1.

What type of vulnerability is CVE-2019-4139?

CVE-2019-4139 is a cross-site scripting (XSS) vulnerability that allows the embedding of arbitrary JavaScript code.

What are the potential consequences of CVE-2019-4139?

Exploitation of CVE-2019-4139 could lead to unauthorized access to user credentials within a trusted session.