PT-2025-2593 · Ibm · Ibm Planning Analytics

Published 2024-11-18 · Updated 2025-01-24 · CVE-2024-40693

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1

Description The issue concerns a malicious file upload risk due to the lack of validation of the content of uploaded files to the web interface. Attackers can exploit this weakness by uploading malicious executable files into the system, which can then be sent to victims for further attacks.

Recommendations For IBM Planning Analytics versions 2.0 through 2.1, consider implementing validation of the content of files uploaded to the web interface to prevent malicious file uploads. As a temporary workaround, restrict access to the file upload feature in the web interface until a proper fix is applied. Avoid using the file upload feature in the affected versions until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2025-02170

CVE-2024-40693

Affected Products

Ibm Planning Analytics

References · 9

• https://osv.dev/vulnerability/CVE-2024-40693 · Vendor Advisory
• https://ibm.com/support/pages/node/7168387 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40693 · Security Note
• https://bdu.fstec.ru/vul/2025-02170 · Security Note
• https://github.com/advisories/GHSA-38fw-44gr-hrfp · Note
• https://vuldb.com/?id.293280 · Note
• https://t.me/cvedetector/16299 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1882873741509562617 · Twitter Post
• https://twitter.com/CVEnew/status/1882815739159048618 · Twitter Post