EUVD-2025-210957
GHSA-qv83-qj3c-qc9v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable source code readable by any authenticated low-privilege user (PR:L), no interaction needed, low confidentiality-only impact and no integrity/availability effect.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system.
AnalysisAI
IBM Cognos Analytics versions 12.0.4 through 12.0.4 FP2 and 12.1.0 through 12.1.3 FP1 embed sensitive information within source code delivered to clients, allowing an authenticated user with access to that code to harvest data that can be used to mount further attacks against the system. The flaw carries a CVSS base score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and requires a valid Cognos Analytics account, so exploitation is gated behind existing credentials or a foothold rather than being openly reachable; impact is limited to low confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis, and the issue has not been confirmed actively exploited (CISA KEV); vendor-released remediation is available, making this a low-priority hardening item rather than an urgent threat.
Technical ContextAI
The root cause class is CWE-540 (Inclusion of Sensitive Information in Source Code), meaning the product ships or serves source artifacts containing embedded secrets, internal endpoints, configuration values, or other data that should never leave server-side execution. Cognos Analytics is an enterprise BI and analytics platform whose web UI and reporting components deliver substantial client-side code and configuration to authenticated sessions; when sensitive material is baked into that delivered code, any user who can load the application can read it with ordinary browser tooling rather than needing a memory-corruption or injection primitive. The affected CPE cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:* denotes the Cognos Analytics product family, with the vulnerable spans being 12.0.4 through 12.0.4 FP2 and 12.1.0 through 12.1.3 FP1. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, the weakness is network-reachable and trivially triggered once authenticated, but its scope is unchanged (S:U) and its consequences are informational only - no direct code execution, privilege escalation, or data tampering is implied by the assessment. The disclosed material is best understood as reconnaissance enabler: credentials, tokens, or internal identifiers leaked this way can lower the cost of follow-on intrusion attempts against connected systems.
RemediationAI
Patch available per vendor advisory: IBM has released remediation and installation guidance at https://www.ibm.com/support/pages/node/7287209, and administrators should apply the fix-pack level indicated there for their Cognos Analytics 12.0.4 and 12.1.x deployments (an exact fix version is not independently confirmed in the supplied data, so validate against the advisory rather than assuming a version number). Because the vulnerability requires an authenticated account, the most effective interim control is to restrict who can reach the Cognos Analytics web interface - enforce least privilege and remove or disable unused and guest accounts, and confine the portal behind VPN or allow-listing so that only trusted networks can load the application code. Note the trade-off: aggressive account pruning and network gating can disrupt legitimate analyst and remote-worker access, so stage changes and communicate them. Additional measures include rotating any credentials, tokens, or connection strings that may have been exposed in delivered source and monitoring egress and authentication logs for anomalous use of discovered internal identifiers. These compensating controls reduce exposure but do not eliminate the underlying information leak, so upgrading remains the primary fix.
More in Cognos Analytics
View allIBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack
IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML dat
IBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system. Rated critical severity (CV
IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) In
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which cou
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to priviledge escalation where a lower evel user could have access
IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neu
IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application l
IBM Cognos Analytics 11.0 and 11.1 could be vulnerable to a denial of service attack by failing to catch exceptions in a
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when proc
IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 could be vulnerable to malicious file upload by
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CS
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today