PT-2025-2386 · Ibm · Ibm Planning Analytics

Published 2024-02-03 · Updated 2025-01-24 · CVE-2024-25034

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: IBM Planning Analytics versions 2.0 through 2.1

Description: The issue concerns a malicious file upload weakness due to the lack of file type validation in the File Manager T1 process. This allows attackers to upload malicious executable files into the system, which can then be sent to victims to perform further attacks.

Recommendations: For IBM Planning Analytics versions 2.0 and 2.1, consider implementing validation for file types in the File Manager T1 process to prevent malicious file uploads. As a temporary workaround, restrict access to the File Manager T1 process until a proper fix is applied. Avoid using the File Manager T1 process for uploading files from untrusted sources until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2025-02171

CVE-2024-25034

Affected Products

Ibm Planning Analytics

References · 9

• https://osv.dev/vulnerability/CVE-2024-25034 · Vendor Advisory
• https://ibm.com/support/pages/node/7168387 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25034 · Security Note
• https://bdu.fstec.ru/vul/2025-02171 · Security Note
• https://github.com/advisories/GHSA-8crw-9p7v-xfx8 · Note
• https://twitter.com/CVEnew/status/1882815740144722080 · Twitter Post
• https://vuldb.com/?id.293281 · Note
• https://t.me/cvedetector/16304 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1882883981839913239 · Twitter Post