Products
IBM Planning Analytics Local
- 2.0
- 2.1
MongoDB
Source
psirt@us.ibm.com
Tags
CVE-2024-35143 details
Published : Aug. 4, 2024, 1:15 p.m.
Last Modified : Aug. 4, 2024, 1:15 p.m.
Last Modified : Aug. 4, 2024, 1:15 p.m.
Description
IBM Planning Analytics Local 2.0 and 2.1 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is configured to allow connections without password authentication. A remote attacker can gain unauthorized access to the database. IBM X-Force ID: 292420.
CVSS Score
1 | 2 | 3 | 4 | 5 | 6.7 | 7 | 8 | 9 | 10 |
---|
Weakness
Weakness | Name | Description |
---|---|---|
CWE-306 | Missing Authentication for Critical Function | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
CVSS Data
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Base Score
6.7
Exploitability Score
1.4
Impact Score
5.2
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
URL | Source |
---|---|
https://exchange.xforce.ibmcloud.com/vulnerabilities/292420 | psirt@us.ibm.com |
https://www.ibm.com/support/pages/node/7157110 | psirt@us.ibm.com |
This website uses the NVD API, but is not approved or certified by it.