CVE-2019-4653: XSS

Published May 31, 2021

Updated

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170964.

Affected Software

3 affected components

IBM Cognos Analytics=11.0.0

IBM Cognos Analytics=11.1.0

NetApp OnCommand Insight

Remediation

Patch Available

https://www.ibm.com/support/pages/node/6451705

Event History

May 31, 2021

CVE Published

via MITRE·03:10 PM

Data Sourced

via MITRE·03:10 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2019-4653.

What is the severity of CVE-2019-4653?

The severity of CVE-2019-4653 is medium with a CVSS score of 5.4.

Which versions of IBM Cognos Analytics are affected by CVE-2019-4653?

IBM Cognos Analytics versions 11.0.0 and 11.1.0 are affected by CVE-2019-4653.

What is the impact of CVE-2019-4653?

CVE-2019-4653 allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

Are there any available fixes for CVE-2019-4653?

Yes, IBM and NetApp have released patches and updates to address the vulnerability. Please refer to the references provided for more information.