IBM Planning Analytics 2.0 and IBM Planning Analytics Workspace 2.0 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote threat actor who can access (without previous authentication) a valid PA endpoint to read and write files to the IBM Planning Analytics system. Depending on file system permissions up to path traversal and possibly remote code execution. IBM X-Force ID: 209511.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-38892
• https://exchange.xforce.ibmcloud.com/vulnerabilities/209511
• https://www.ibm.com/support/pages/node/6524704