PT-2025-23426 · Ibm · Ibm Planning Analytics

Published 2025-05-30 · Updated 2025-06-01 · CVE-2025-33005

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics Local versions 2.0 through 2.1

Description The issue allows an authenticated user to impersonate another user on the system because the session is not invalidated after a logout.

Recommendations For versions 2.0 and 2.1, consider implementing a manual session invalidation mechanism after each logout to prevent impersonation until a patch is available. As a temporary workaround, restrict access to sensitive features that could be exploited by an impersonated user.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BDU:2025-09705

CVE-2025-33005

Affected Products

Ibm Planning Analytics

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-33005 · Security Note
• https://osv.dev/vulnerability/CVE-2025-33005 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09705 · Security Note
• https://ibm.com/support/pages/node/7235182 · Vendor Advisory, Patch
• https://t.me/cvetracker/25101 · Telegram Post
• https://t.me/cvenotify/124268 · Telegram Post
• https://twitter.com/CVEnew/status/1929143542716195292 · Twitter Post