CVEvulnerability

CVE-2024-35143

9.1 CRITICAL Published 2024-08-04 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-08-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.7 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-306

Description

IBM Planning Analytics Local 2.0 and 2.1 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is configured to allow connections without password authentication. A remote attacker can gain unauthorized access to the database. IBM X-Force ID: 292420.

Affected configurations

• ibm planning analytics workspace (>= 2.0 < 2.0.97) • ibm planning analytics workspace (>= 2.1 < 2.1.4) • ibm planning analytics local (>= 2.0 < 2.0.97) • ibm planning analytics local (>= 2.1.0 < 2.1.4)

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References