CVE-2025-2896: IBM Planning Analytics Local cross-site scripting
IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Other sources
IBM Planning Analytics Local is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
— IBM
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2896?
CVE-2025-2896 has been assigned a high severity due to its potential to allow authenticated users to execute arbitrary JavaScript code.
How do I fix CVE-2025-2896?
To fix CVE-2025-2896, upgrade IBM Planning Analytics Local to version 2.2 or later.
Who is affected by CVE-2025-2896?
CVE-2025-2896 affects users of IBM Planning Analytics Local versions 2.0 and 2.1.
What are the impacts of CVE-2025-2896?
CVE-2025-2896 can lead to compromise of user credentials and unauthorized actions within the application.
Is CVE-2025-2896 being actively exploited?
As of now, there are no public reports indicating active exploitation of CVE-2025-2896, but it is advisable to address the vulnerability promptly.