IBM Cognos TM1 CVE-2016-3038 Cross Site Scripting Vulnerability

Bugtraq ID:	97915
Class:	Input Validation Error
CVE:	CVE-2016-3038
Remote:	Yes
Local:	No
Published:	Apr 13 2017 12:00AM
Updated:	May 02 2017 03:06AM
Credit:	Stephen Deck at Synovus
Vulnerable:	IBM Cognos TM1 10.2.2 IBM Cognos TM1 10.2 IBM Cognos TM1 10.1.0
Not Vulnerable:	IBM Cognos TM1 10.2.2 Fix Pack 7 IBM Cognos TM1 10.2.0.2 Interim Fix IBM Cognos TM1 10.1.1.2 Interim Fix

IBM Cognos TM1 CVE-2016-3038 Cross Site Scripting Vulnerability

IBM Cognos TM1 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials.

Cognos TM1 10.1, 10.2 and 10.2.2 are vulnerable.

IBM Cognos TM1 CVE-2016-3038 Cross Site Scripting Vulnerability

To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting user to follow a malicious URI.

IBM Cognos TM1 CVE-2016-3038 Cross Site Scripting Vulnerability

Solution:
Vendor updates are available. Please see the references for details.

IBM Cognos TM1 CVE-2016-3038 Cross Site Scripting Vulnerability

References:

• Cognos TM1 Homepage (IBM)
  
• IBM Homepage (IBM)
  
• swg21999649 : Multiple Security Vulnerabilities exist in IBM Cognos TM1 (IBM)