CVE-2019-4716: IBM Planning Analytics Remote Code Execution Vulnerability
Critical · CVSS 10.0 (CVSS 3.1)KEV known exploitedEPSS 86.4%, 100th percentilePublished Updated Assigner: ibm
In CISA’s Known Exploited Vulnerabilities catalog: IBM Planning Analytics Remote Code Execution Vulnerability.
Added , federal remediation due . Known ransomware use: Unknown.
Required action: Apply updates per vendor instructions.
Description
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.
Vector CVSS:3.0/UI:N/AC:L/PR:N/I:H/S:C/AV:N/C:H/A:H/RC:C/RL:O/E:U
Status incidents that name it
No tracked status incident names this CVE.
Affected vendors and products
IBM: Planning Analytics
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- packetstormsecurity.com/files/156953/IBM-Cognos-TM1-IBM-Planning-Analytics-Server-Configurati… (opens in new tab)
- seclists.org/fulldisclosure/2020/Mar/44 (opens in new tab)
- exchange.xforce.ibmcloud.com/vulnerabilities/172094 (opens in new tab)
- www.ibm.com/support/pages/node/1127781 (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)