IBM Cognos Analytics CVE-2025-3633

Exploitation requires an attacker to inject arbitrary JavaScript into the Cognos Analytics/Transformer web user interface AND a victim to interact with the malicious content (UI:R) - typically by clicking a crafted link or viewing an attacker-controlled page/input within the application. The payload executes only in the context of the victim's active, authenticated Cognos session, so the realistic impact (credential disclosure, UI manipulation) is bounded to that user's privileges and requires a live trusted session to be valuable. Limiting factors: the mandatory user-interaction step, the need for a victim with an active session, and dependence on the attacker being able to get the script into a page the victim will load; the input data does not confirm whether placing a stored payload itself requires prior authentication.

Signals are consistent and point to a moderate, not urgent, priority. The CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) is elevated primarily by the changed scope and high confidentiality impact typical of cross-site scripting, but exploitation still requires user interaction (UI:R), which materially lowers real-world likelihood. Every exploitation-likelihood signal agrees on low urgency: EPSS is 0.03% (10th percentile), the CISA SSVC decision framework records Exploitation: none, Automatable: no, and Technical Impact: partial, and there is no public exploit identified at time of analysis. The high CVSS is therefore driven by potential impact (credential disclosure in a trusted session) rather than by demonstrated or probable exploitation - this is a high-severity-rating, low-current-real-risk issue that should be patched on a normal cycle rather than as an emergency. One caveat: the C:H rating for an XSS that 'could lead to disclosure of credentials' is somewhat generous, and the vendor-supplied PR:N assumes the injection requires no prior authentication, which the description does not explicitly confirm.

An attacker crafts a malicious link or input containing JavaScript that is reflected or stored in the IBM Cognos Analytics/Transformer web interface, then lures an authenticated user into viewing it. When the victim's browser renders the page, the script executes in their trusted session and can exfiltrate session credentials or alter UI behavior. No public exploit code is identified at time of analysis, and successful attack depends on user interaction (UI:R).