IBM · Planning Analytics
CVE-2019-4716
IBM Planning Analytics Remote Code Execution Vulnerability
What it is
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.
CISA: IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
More exploited flaws from IBM
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 4, 2026 | Code Injection | Langflow | Critical 9.8 | 29% |
| Feb 21, 2023 | Code Execution | Aspera Faspex | Critical 9.8 | >99.9% |
| May 25, 2022 | Invalid Input | InfoSphere BigInsights | Medium 6.5 | 4.8% |
| Jan 10, 2022 | Code Injection. | WebSphere Application Server and Server Hypervisor Edition | Critical 9.8 | 98% |
| Nov 3, 2021 | Security Bypass | Data Risk Manager | Critical 9.0 | 70% |
| Nov 3, 2021 | Remote Code Execution | Data Risk Manager | Critical 9.1 | 62% |
| Nov 3, 2021 | Directory Traversal | Data Risk Manager | Medium 4.3 | 69% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.