CVE-2019-4716 — IBM Planning Analytics Remote Code Execution Vulnerability

provenance: imported · CVE: CVE-2019-4716

CVE-2019-4716: IBM Planning Analytics Remote Code Execution Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	IBM
Product	Planning Analytics
Date added	2021-11-03
Due date	2022-05-03
Ransomware campaign use	Unknown

Description

IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting.

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2019-4716

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-4716
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog