CVE-2019-4716
Published: 18 December 2019
Summary
CVE-2019-4716 is a critical-severity Code Injection (CWE-94) vulnerability in Ibm Planning Analytics. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and CM-5 (Access Restrictions for Change).
Deeper analysis
IBM Planning Analytics versions 2.0.0 through 2.0.8 contain a configuration overwrite vulnerability tracked as CVE-2019-4716. The flaw, assigned CWE-94, permits modification of server settings in the TM1 component and carries a CVSS 3.1 base score of 9.8.
An unauthenticated remote attacker can leverage the issue to authenticate as the built-in admin account and subsequently execute arbitrary code with root or SYSTEM privileges through TM1 scripting.
Publicly available advisories and exploit references, including the IBM support page and X-Force entry, point to official patches and configuration guidance for affected deployments. Separate disclosures on Packet Storm and Full Disclosure include proof-of-concept code demonstrating the configuration overwrite and subsequent code execution.
The vulnerability was publicly detailed with working exploits in March 2020.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-14323
Vulnerability details
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces access control decisions to block unauthenticated configuration overwrites that permit admin login and subsequent root/SYSTEM code execution via TM1 scripting.
Restricts access to configuration changes on the TM1 server, preventing the unauthenticated overwrite of settings that enables admin impersonation and privileged code execution.
Requires timely application of vendor patches that close the configuration overwrite flaw in IBM Planning Analytics 2.0.0-2.0.8 before exploitation occurs.