CVE-2021-38892

 

Published at: - 12-01-2022 06:15

Last modified: - 20-01-2022 02:53

Total changes: - 2

Description

IBM Planning Analytics 2.0 and IBM Planning Analytics Workspace 2.0 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote threat actor who can access (without previous authentication) a valid PA endpoint to read and write files to the IBM Planning Analytics system. Depending on file system permissions up to path traversal and possibly remote code execution. IBM X-Force ID: 209511.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• ibm-planning-cve202138892-code-exec (209511)-VDB Entry, Vendor Advisory
• https://www.ibm.com/support/pages/node/6524704

 

Keywords

NVD

 

CVE-2021-38892

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures