Security readout for executives and security teams
Plain-English summary
IBM Cognos Analytics 11.1 and 11.2 can allow cross-site scripting in the Web UI. A user could embed JavaScript that changes page behavior and may expose credentials inside a trusted session. The CVSS score is medium, and the source bundle does not show known active exploitation.
Executive priority
Treat as a scheduled but real remediation item. It is not KEV-listed and has medium severity, but it can affect credential confidentiality inside trusted analytics sessions, which may matter in sensitive reporting environments.
Technical view
CVE-2023-25929 is CWE-79 XSS in IBM Cognos Analytics 11.1 and 11.2. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, indicating low-privileged access and user interaction are required, with limited confidentiality and integrity impact.
Likely exposure
Exposure is most likely where IBM Cognos Analytics 11.1 or 11.2 is deployed and accessible to authenticated business users through the Web UI. Risk increases with broad user access or shared administrative workflows.
Exploitation context
The bundle does not identify public exploitation or CISA KEV listing. Exploitation requires an authenticated or low-privileged context and user interaction, so the primary concern is abuse within trusted Cognos sessions rather than unauthenticated remote takeover.
Researcher notes
Evidence supports a vendor-confirmed XSS with low privileges and user interaction required. The source bundle does not include exact fixed versions or proof of exploitation, so validation should stay focused on affected version discovery and IBM advisory status.
Mitigation direction
- Review IBM advisory 7012621 for the vendor-supported fix or mitigation.
- Identify all IBM Cognos Analytics 11.1 and 11.2 deployments.
- Restrict Cognos access to required users until remediation is complete.
- Review NetApp advisory if Cognos is present in NetApp-managed environments.
- Monitor IBM X-Force entry 247861 for updated guidance.
Validation and detection
- Confirm deployed Cognos Analytics versions against the affected 11.1 and 11.2 range.
- Verify remediation status against IBM advisory guidance, not assumptions.
- Review access controls for users allowed to create or modify Web UI content.
- Check security monitoring for suspicious script-like content in Cognos-managed UI fields.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-25929 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N2.12.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.6MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/pages/node/7012621CVE reference · vendor-advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/247861CVE reference · vdb-entry
- https://security.netapp.com/advisory/ntap-20230814-0005/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.