PT-2021-12250 · Ibm · Ibm Planning Analytics

Published 2021-02-23 · Updated 2021-02-26 · CVE-2020-4953

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics version 2.0

Description The issue allows a remote authenticated attacker to obtain information about an organization's internal structure by exposing sensitive information in HTTP responses.

Recommendations For IBM Planning Analytics version 2.0, consider restricting access to sensitive information in HTTP responses until a patch is available. As a temporary workaround, review and modify the HTTP response handling to prevent the exposure of sensitive information.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-4953

Affected Products

Ibm Planning Analytics

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-4953 · Security Note
• https://osv.dev/vulnerability/CVE-2020-4953 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/192029 · Vendor Advisory
• https://ibm.com/support/pages/node/6412707 · Vendor Advisory
• https://t.me/cvenotify/10575 · Telegram Post
• https://t.me/cibsecurity/23987 · Telegram Post