description: IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. User input could be passed into file include commands and the web application could be tricked into including remote files with malicious code. IBM X-Force ID: 216891.
problem types: Gain Access
affected:
{
product: Planning Analytics
vendor: IBM
versions:
status: affected, version: 2.0
}
{
product: Planning Analytics Workspace
vendor: IBM
versions:
status: affected, version: 2.0
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: UNPROVEN
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 6.2
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.0/S:U/PR:N/C:H/A:L/I:H/UI:R/AV:N/AC:H/RL:O/RC:C/E:U
version: 3.0
]