PT-2022-10859 · Ibm · Ibm Planning Analytics Workspace

Published 2022-04-25 · Updated 2022-05-03 · CVE-2021-39040

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics Workspace version 2.0

Description The issue allows malicious file upload by not validating the file types or sizes. Attackers can exploit this weakness to upload malicious executable files into the system, which can then be sent to victims for further attacks.

Recommendations For IBM Planning Analytics Workspace version 2.0, consider implementing file type and size validation to prevent malicious file uploads until a patch is available. As a temporary workaround, restrict access to file upload functionality to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-39040

Affected Products

Ibm Planning Analytics Workspace

References · 6

• https://ibm.com/support/pages/node/6574003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39040 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/214025 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39040 · Vendor Advisory
• https://t.me/cvenotify/29647 · Telegram Post
• https://t.me/cibsecurity/41401 · Telegram Post