Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

IBM Cognos Analytics can let attackers steal login cookies

CVE-2016-0217 · published 9 years ago
Summary

IBM Cognos Analytics does not properly check data that users enter, allowing a malicious script to be saved on the server. If someone views the compromised page, the script runs in their browser and can capture their login cookies. Update the software or apply the vendor's patch to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm cognos_analytics 11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
cpe:2.3:a:ibm:cognos_analytics:11.0.0:*:*:*:*:*:*:*
Original advisory text
IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this v...
IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published1 Feb 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-0217 · NVD
Track software like this
Free during beta