CVE-2020-4649 Information disclosure in Planning Analytics Local

Medium 4.3 Published 3 Nov 2020 Updated 16 Sep 2024

Attackers can access sensitive data by exploiting non-invalidated user sessions in IBM Planning Analytics applications.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-4649?

CVE-2020-4649 is a medium-severity vulnerability in IBM Planning Analytics Local, published on 3 Nov 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions. IBM X-Force ID: 186022.

Weakness: CWE-200

Which versions are affected by CVE-2020-4649?

It affects 1 product.

Products include Ibm Planning Analytics Local.

How do I fix CVE-2020-4649?

No fix has been published for CVE-2020-4649 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-4649 being exploited?

There is no known exploitation of CVE-2020-4649 in the wild and no public exploit code.

Sources

Also known as GHSA-xm98-722w-4373.