PT-2021-12153 · Ibm+1 · Ibm Planning Analytics Local+1

Published 2021-05-17 · Updated 2021-05-24 · CVE-2020-4669

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics Local version 2.0

Description The issue concerns a configuration where MongoDB, a document-oriented database system, is listening on a remote port without password authentication, allowing a remote attacker to gain unauthorized access to the database. This setup enables potential exploitation, compromising the security of the database.

Recommendations For IBM Planning Analytics Local version 2.0, consider configuring MongoDB to require password authentication for connections to prevent unauthorized access. As a temporary workaround, restrict access to the MongoDB server to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-4669

Affected Products

Ibm Planning Analytics Local

Mongodb

References · 5

• https://osv.dev/vulnerability/CVE-2020-4669 · Vendor Advisory
• https://ibm.com/support/pages/node/6436821 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/186400 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4669 · Security Note
• https://t.me/cvenotify/14934 · Telegram Post