#VU59560 Improper Authentication in Planning Analytics Local - CVE-2021-38892

Vulnerability identifier: #VU59560

Vulnerability risk: Critical

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Red]

CVE-ID: CVE-2021-38892

CWE-ID: CWE-287

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Planning Analytics Local
Client/Desktop applications / Office applications

Vendor: IBM Corporation

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to DQM API allows submitting of all control requests in unauthenticated sessions. A remote attacker can access a valid PA endpoint to read and write files to the IBM Planning Analytics system.

Successful exploitation of the vulnerability may result in complete compromise of the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Planning Analytics Local: 2.0.0 - 2.0.9.10

---

External links
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-planning-analytics-and-ibm-planning-analytics-workspace-are-affected-by-security-vulnerabilities/
https://www.ibm.com/support/pages/node/6524704

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.