cyfenced.com →

[ CVE-2019-4716 · Published 18 Dec 2019 ]

IBM Planning Analytics Remote Code Execution Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 86%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
  • EPSS: 86% chance of exploitation in the next 30 days (higher than 100% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.

CISA: IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.

  • Patch on ibm.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References