CVE-2021-39047: 
IBM Planning Analytics vulnerability analysis and mitigation

IBM Planning Analytics 2.0 and IBM Cognos Analytics versions 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting (CVE-2021-39047). This vulnerability was discovered and disclosed in June 2022, affecting the web user interface of these applications. The vulnerability allows users to embed arbitrary JavaScript code in the Web UI, which could potentially lead to credentials disclosure within a trusted session (IBM Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability can be exploited remotely (Network), requires Low attack complexity, needs No privileges, requires User interaction, has Changed scope, and can result in Low confidentiality and integrity impact, with No availability impact (NVD).

When successfully exploited, this cross-site scripting vulnerability can allow attackers to alter the intended functionality of the web interface and potentially lead to the disclosure of user credentials within a trusted session. The vulnerability affects the security of user sessions and could compromise user authentication data (IBM Advisory, NetApp Advisory).

The vulnerability requires user interaction for successful exploitation, suggesting that an attacker would need to convince a user to interact with malicious content. The attack vector is network-accessible, and no special privileges are required to attempt exploitation (NVD).

IBM has released patches to address this vulnerability. Users of affected systems should upgrade to the latest versions of the software. For IBM Planning Analytics Local, users should update to Planning Analytics Workspace 2.0.74 or later. For IBM Cognos Analytics, the vulnerability has been addressed in version 11.1.7 FP5 and IBM Cognos Analytics 11.2.2 (IBM Advisory).