IBM Planning Analytics Malicious File Upload Vulnerability

A malicious file upload vulnerability has been identified in IBM Planning Analytics versions 2.0 and 2.1. The issue arises because the application does not properly validate the content of files uploaded through the web interface. This lack of validation allows attackers to upload harmful executable files into the system, which can then be sent to victims to facilitate further attacks.

Impact

Exploitation of this vulnerability could lead to unauthorized file uploads, allowing for the distribution of malicious executable files that could be used to conduct additional attacks on victims.

Remediation

Users are advised to upgrade to IBM Planning Analytics Local version 2.1.6 or version 2.0: Planning Analytics Workspace Release 99. Instructions for downloading these versions are available on Fix Central. IBM Planning Analytics Workspace cloud environments have been remediated.