CVE-2020-4653

Vulnerability

IBM Planning Analytics 2.0 Workspace contains an open redirect vulnerability (CVE-2020-4653) that allows a remote attacker to craft a URL that appears to redirect to a trusted site but instead leads to a malicious destination. The vulnerability resides in the web application components of IBM Planning Analytics Workspace, specifically affecting versions prior to Planning Analytics Workspace Release 55 (included in IBM Planning Analytics Local v2.0) [1].

Exploitation

To exploit this vulnerability, an attacker must have a valid account (low-privilege access) on the IBM Planning Analytics system. The attacker crafts a specially designed link that leverages the open redirect functionality and then tricks an authenticated victim into clicking it, for example via email or social engineering. The victim's user interaction is required to trigger the redirect [1].

Impact

Successful exploitation allows the attacker to redirect the victim to a malicious website that appears trustworthy. This can lead to the theft of highly sensitive information (such as credentials) or enable further attacks against the victim. The confidentiality of user data is impacted due to the potential for information disclosure [1].

Mitigation

The vulnerability is fixed in IBM Planning Analytics Workspace Release 55, which is included in IBM Planning Analytics Local v2.0. Users should upgrade to this release or later. The fix was published on August 19, 2020 [1]. No workarounds are documented; upgrading is the recommended mitigation.