IBM Cognos Analytics versions 12.1.0 through 12.1.3 FP1 and 12.0.4 through 12.0.4 FP2 contain a vulnerability that allows non-privileged users to inject malicious JavaScript code into their given name and surname fields. When an administrator views the affected user's permissions in the user account management panel, the malicious script executes, potentially compromising the administrator's cookies. This vulnerability is classified as a medium severity reflected by a CVSS score of 5.4.