CVE-2019-4716criticalunder attackCWE-94

CVE-2019-4716: critical vulnerability in IBM Planning Analytics

Published · Updated

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 10epss 86%
from disclosure to weapon104 days
Published on NVDDec 18
1st PoC+104d
metasploit+1d
CISA KEV+686d
exploitation probability
86%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
2 public exploit(s)
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

IBM Planning Analytics allows anyone to log in as an administrator without a password and run dangerous commands with the highest system permissions. This is a critical flaw that gives complete control of the system to attackers.

Technical detail

An unauthenticated attacker can exploit a configuration overwrite vulnerability to gain admin credentials, then leverage TM1 scripting functionality to achieve remote code execution with root/SYSTEM privileges. The vulnerability affects versions 2.0.0 through 2.0.8 and requires no prior access or authentication.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.
CVSS:3.0/UI:N/AC:L/PR:N/I:H/S:C/AV:N/C:H/A:H/RC:C/RL:O/E:U
Affected products
IBM · Planning Analytics
public PoCs found — 2✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/48273cve_referencepacketstormsecurity.com/files/156953/IBM-Cognos-TM1-IBM-Planning-Analytics-Server-Configuration-Overwrite-Code-Execution.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — IBM Planning Analytics

In the same product, most dangerous first.

CVE-2021-38873MEDIUMCVE-2021-38873EPSS 1.8%CVE-2020-4527MEDIUMCVE-2020-4527EPSS 1.3%CVE-2020-4562MEDIUMCVE-2020-4562EPSS 1.3%CVE-2020-4644MEDIUMCVE-2020-4644EPSS 1.2%CVE-2020-4953MEDIUMCVE-2020-4953EPSS 1.2%CVE-2021-20526LOWCVE-2021-20526EPSS 1.1%
References
http://packetstormsecurity.com/files/156953/IBM-Cognos-TM1-IBM-Planning-Analytics-Server-Configuration-Overwrite-Code-Execution.htmlhttp://seclists.org/fulldisclosure/2020/Mar/44https://exchange.xforce.ibmcloud.com/vulnerabilities/172094https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-4716https://www.ibm.com/support/pages/node/1127781