IBM Cognos Analytics versions 12.0.4 through 12.0.4 FP2 and 12.1.0 through 12.1.3 FP1 have a vulnerability due to improper enforcement of HTTP Strict Transport Security (HSTS). This failure can be exploited by remote attackers to obtain sensitive information by leveraging man-in-the-middle techniques. The underlying weakness is classified as CWE-327, indicating the use of a broken or risky cryptographic algorithm. The CVSS 3.1 base score is 5.9, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impact on confidentiality only.

An attacker could exploit this vulnerability to intercept and obtain sensitive information transmitted between clients and the IBM Cognos Analytics server by performing man-in-the-middle attacks. The confidentiality of data is impacted, but integrity and availability are not affected. No known exploits are reported in the wild at this time.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider mitigating the risk by ensuring secure transport configurations and monitoring for suspicious network activity related to man-in-the-middle attempts.