IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HIBM Planning Analytics
APPIbm2.0 β 2.0.8
CISA KEV β detailsi
- Vendori
- IBM β
- Producti
- Planning Analytics
- Added to KEVi
- November 3, 2021
- Remediation deadline (US Federal)i
- May 3, 2022(overdue)
Apply updates per vendor instructions.
IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting.
Related vulnerabilities
IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the type of ...
IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the content ...
IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improp...
IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticate...
IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. User input could be passed int...