PT-2016-4096 · Ibm · Ibm Cognos Business Intelligence+1

Jakub Palaczynski · Published 2016-07-03 · Updated 2017-09-01 · CVE-2016-0221

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Cognos Business Intelligence versions 10.1.1 before IF19 IBM Cognos Business Intelligence versions 10.2 before IF20 IBM Cognos Business Intelligence versions 10.2.1 before IF17 IBM Cognos Business Intelligence versions 10.2.1.1 before IF16 IBM Cognos Business Intelligence versions 10.2.2 before IF12

Description A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. This affects IBM Cognos TM1, as used in IBM Cognos Business Intelligence.

Recommendations For IBM Cognos Business Intelligence version 10.1.1, update to IF19 or later. For IBM Cognos Business Intelligence version 10.2, update to IF20 or later. For IBM Cognos Business Intelligence version 10.2.1, update to IF17 or later. For IBM Cognos Business Intelligence version 10.2.1.1, update to IF16 or later. For IBM Cognos Business Intelligence version 10.2.2, update to IF12 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-0221

Affected Products

Ibm Cognos Business Intelligence

Ibm Cognos Tm1

References · 5

• http://www-01.ibm.com/support/docview.wss?uid=swg21984323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0221 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0221 · Vendor Advisory
• http://securityfocus.com/bid/91542 · Note
• http://securitytracker.com/id/1036221 · Note