The vulnerability arises from improper output encoding in IBM Planning Analytics 2.0 and 2.1, which allows a remote authenticated attacker to inject arbitrary JavaScript that is then executed in the victim’s browser context. This client‑side code execution can lead to unauthorized data exposure, credential theft, or further exploitation depending on user privileges. The flaw is categorized as CWE‑79.

IBM Planning Analytics Local, versions 2.0.x and 2.1.0 to 2.1.23, are impacted. Versions 2.1.24 and later contain the fix. The Cloud deployment has already been remediated.

The CVSS score of 5.4 indicates a moderate severity. Exploitation requires valid user credentials; there is no EPSS score available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can craft a malicious URL or input that is reflected or stored, leading to cross‑site scripting when the authenticated user accesses the affected page. The risk includes data theft and potential session hijacking, but no evidence of active exploitation currently.