CVE-2020-4873 : IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive informati

IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 190836.

Published 2021-01-19 16:15:13

Updated 2021-07-21 11:39:24

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2020-4873

IBM » Planning Analytics » Version: 2.0
cpe:2.3:a:ibm:planning_analytics:2.0:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 31 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	IBM Corporation
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Assigned by: nvd@nist.gov (Primary)

https://exchange.xforce.ibmcloud.com/vulnerabilities/190836

IBM Planning Analytics information disclosure CVE-2020-4873 Vulnerability Report
VDB Entry;Vendor Advisory
https://www.ibm.com/support/pages/node/6404674

Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities
Patch;Vendor Advisory

CVEs referencing this url

Jump to