CVE-2024-25034

CVSS v3 8.0 HIGH

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

I

BM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the type of file in the File Manager T1 process. Attackers can make use of this weakness and upload malicious executable files into the system that can be sent to victims for performing further attacks.

References

Link	Resource
https://www.ibm.com/support/pages/node/7168387	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:planning_analytics:2.0:::::::*
	cpe:2.3:a:ibm:planning_analytics:2.1:::::::*

History

05 Mar 2025, 16:01

Type	Values Removed	Values Added
References	~~() https://www.ibm.com/support/pages/node/7168387 -~~	() https://www.ibm.com/support/pages/node/7168387 - Vendor Advisory
First Time		Ibm Ibm planning Analytics
CPE		cpe:2.3:a:ibm:planning_analytics:2.0:::::::* cpe:2.3:a:ibm:planning_analytics:2.1:::::::*
Summary		(es) IBM Planning Analytics 2.0 y 2.1 podrían ser vulnerables a la carga de archivos maliciosos al no validar el tipo de archivo en el proceso T1 de File Manager. Los atacantes pueden aprovechar esta debilidad y cargar archivos ejecutables maliciosos en sistema que pueden enviarse a las víctimas para realizar ataques posteriores.

24 Jan 2025, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-24 16:15

Updated : 2025-03-05 16:01

NVD link : CVE-2024-25034

Mitre link : CVE-2024-25034

CVE.ORG link : CVE-2024-25034

JSON object : View

Products Affected

planning_analytics

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2024-25034", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-01-24T16:15:34.747", "references": [{"url": "https://www.ibm.com/support/pages/node/7168387", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the type of file in the File Manager T1 process. Attackers can make use of this weakness and upload malicious executable files into the system that can be sent to victims for performing further attacks."}, {"lang": "es", "value": "IBM Planning Analytics 2.0 y 2.1 podr\u00edan ser vulnerables a la carga de archivos maliciosos al no validar el tipo de archivo en el proceso T1 de File Manager. Los atacantes pueden aprovechar esta debilidad y cargar archivos ejecutables maliciosos en sistema que pueden enviarse a las v\u00edctimas para realizar ataques posteriores."}], "lastModified": "2025-03-05T16:01:58.133", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:planning_analytics:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "965D63C3-4927-4C7A-9509-017A73A0E7A9"}, {"criteria": "cpe:2.3:a:ibm:planning_analytics:2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69029120-4E5D-4C3A-8CE0-391D43156DAF"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}