CVE-2019-4645: XSS

Published Nov 9, 2019

Updated

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170881.

Other sources

IBM Cognos Analytics could be vulnerable to a XSS attack in the Assistant Search tab via .xlsx file upload.

— IBM

Affected Software

2 affected components

IBM Cognos Analytics=11.0.0

IBM Cognos Analytics=11.1.0

Remediation

Patch Available

https://www.ibm.com/support/pages/node/1074144

Event History

Nov 9, 2019

CVE Published

via MITRE·01:41 AM

Data Sourced

via MITRE·01:41 AM

DescriptionSeverityWeakness

Aug 4, 2024

Data Sourced

via IBM·07:42 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-1074144

Frequently Asked Questions

What is the severity of CVE-2019-4645?

CVE-2019-4645 is considered a medium severity cross-site scripting (XSS) vulnerability.

How does CVE-2019-4645 affect IBM Cognos Analytics?

CVE-2019-4645 allows a user to execute arbitrary JavaScript code through the Assistant Search tab via .xlsx file upload.

What versions of IBM Cognos Analytics are affected by CVE-2019-4645?

IBM Cognos Analytics versions 11.0.0 and 11.1.0 are affected by CVE-2019-4645.

How do I fix CVE-2019-4645?

To fix CVE-2019-4645, it is recommended to upgrade IBM Cognos Analytics to the latest secure version provided by IBM.

Is there any workaround for CVE-2019-4645?

As a temporary workaround for CVE-2019-4645, avoid uploading .xlsx files to the Assistant Search tab until a patch is applied.