IBM Cognos Analytics versions 12.1.0 through 12.1.3 FP1 and 12.0.4 through 12.0.4 FP2 contain a CWE-79 improper neutralization of input vulnerability. A non-privileged user can insert malicious JavaScript code into their profile fields (given name and surname). This code executes when an administrator accesses the user account management panel and views the user's permissions, leading to potential cookie theft from the administrator's session.

The vulnerability can lead to the compromise of administrator cookies, which may allow an attacker to hijack administrator sessions or perform actions with elevated privileges. The CVSS score of 5.4 indicates a medium severity impact with confidentiality and integrity impacts but no availability impact.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict non-privileged users from editing profile fields that are rendered in administrator views or apply input validation and output encoding controls to prevent script injection.