High severity · published Jan 24, 2025
CVE-2024-40693
IBM Planning Analytics file upload
8.0
CVSS
0.4%
EPSS
No
On KEV
Description
IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Planning Analytics Local · IBM
2.0, 2.1 · source: vendor
PA
Planning Analytics · Ibm
2.0; 2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-40693
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-40693
Vendor Advisory
https://www.ibm.com/support/pages/node/7168387
More from Planning Analytics Local
9.1
CVE-2024-35143
IBM Planning Analytics Local missing authentication
9.1
CVE-2020-4670
IBM Planning Analytics Local 2.0 connects to a Redis server
9.1
CVE-2020-4669
IBM Planning Analytics Local 2.0 connects to a MongoDB server
8.8
CVE-2025-33005
IBM Planning Analytics Local session fixation
8.8
CVE-2024-25034
IBM Planning Analytics file upload