Cross-site request forgery (CSRF) vulnerability in IBM Cognos Express 9.0 before IFIX 2 9.5 before IFIX 2 10.1 before IFIX 2 and 10.2.1 before FP1 allows remote attackers to hijack the authentication of arbitrary users.