VulnerabilityModified
CVE-2019-4612
IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal.
HIGH 8.8EPSS 0.95%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.95%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 168523.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.95% probability · 59th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-434
- Affected
- ibm/planning analytics
- Source
- psirt@us.ibm.com
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/168523VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/1118565Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/168523VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/1118565Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.