CVE-2025-3633: cognos analytics 11.2.4; +3 more affected products

Affected technology

cognos analytics · from 11.2.0 (inclusive), before 11.2.4 (exclusive)
ibm

cognos analytics · from 12.0.0 (inclusive), before 12.0.4 (exclusive)
ibm

cognos analytics · from 12.1.0 (inclusive), before 12.1.2 (exclusive)
ibm

cognos analytics · 11.2.4
ibm

cognos analytics · 11.2.4 · update fixpack1
ibm

cognos analytics · 11.2.4 · update fixpack2
ibm

cognos analytics · 11.2.4 · update fixpack3
ibm

cognos analytics · 11.2.4 · update fixpack4
ibm

cognos analytics · 11.2.4 · update fixpack5
ibm

cognos analytics · 11.2.4 · update fixpack6
ibm

cognos analytics · 11.2.4 · update interim_fix_1
ibm

cognos analytics · 11.2.4 · update interim_fix_2
ibm

cognos analytics · 11.2.4 · update interim_fix_3
ibm

cognos analytics · 11.2.4 · update interim_fix_4
ibm

cognos analytics · 11.2.4 · update interim_fix_5
ibm

cognos analytics · 12.0.4 · update interim_fix_1
ibm

cognos analytics · 12.0.4 · update interim_fix_2
ibm

cognos analytics · 12.0.4 · update interim_fix_3
ibm

cognos transformer · 11.2.4
ibm

cognos transformer · 12.0
ibm

cognos transformer · 12.1.0
ibm

Cognos Analytics · 11.2.0, 12.0, 12.1.0
IBM

Cognos Transformer · 12.0, 11.2.4, 12.1.0
IBM

Description’s affected range: 12.1.0 and IBM Cognos Transformer 11.2.4, 12.0, and 12.1.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

A remote attacker can inject arbitrary JavaScript code into the web user interface, which may alter the intended functionality and could lead to the disclosure of credentials within a trusted session. Vendor/CNA’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none. NVD’s CVSS 3.1 assessment (base score 8.2/10) rates confidentiality impact as high; integrity impact as low; availability impact as none.