CVE-2018-1933

Vulnerability

IBM Planning Analytics versions 2.0 through 2.0.6 are vulnerable to cross-site scripting (XSS) via the Web UI. The vulnerability resides in the dojo create_widgets.html component (part of the Dojo Toolkit used by PMHub) [1]. User-supplied input is not properly sanitized, allowing attackers to embed arbitrary JavaScript code that executes in the context of a trusted session.

Exploitation

An attacker requires no special network position beyond being able to submit crafted input to the affected Web UI component. The attacker must have a valid user account with access to the Planning Analytics interface [1]. The exploitation steps involve injecting malicious script into input fields that are later rendered in a victim's browser without proper encoding, leading to execution of the attacker's code when the victim views the affected page.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to credentials disclosure, session hijacking, or other actions that the authenticated user could perform, potentially compromising the integrity and confidentiality of the Planning Analytics instance [1].

Mitigation

IBM Planning Analytics version 2.0.7, released in conjunction with the associated security bulletin, addresses this vulnerability [1]. Users should upgrade to 2.0.7 or later. No workaround beyond upgrading is documented in the provided references [1].