PT-2021-22302 · Ibm · Ibm Planning Analytics

Published 2021-11-24 · Updated 2021-11-24 · CVE-2021-38873

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics version 2.0

Description The issue is related to CSV Injection, where a remote attacker could execute arbitrary commands on the system due to improper validation of csv file contents. This allows for the potential execution of commands, posing a risk to the system's security.

Recommendations For IBM Planning Analytics version 2.0, consider implementing proper validation of csv file contents to prevent arbitrary command execution. As a temporary workaround, restrict the ability to upload or process csv files from untrusted sources until a fix is available.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2021-38873

Affected Products

Ibm Planning Analytics

References · 6

• https://osv.dev/vulnerability/CVE-2021-38873 · Vendor Advisory
• https://ibm.com/support/pages/node/6517470 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/208396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38873 · Security Note
• https://t.me/cibsecurity/32972 · Telegram Post
• https://t.me/cvenotify/23739 · Telegram Post