CVE-2020-4953

Vulnerability

IBM Planning Analytics 2.0 allows a remote authenticated attacker to obtain information about an organization's internal structure by exposing sensitive information in HTTP responses. This vulnerability affects IBM Planning Analytics version 2.0. The issue is addressed in IBM Planning Analytics Workspace Release 61 [1].

Exploitation

An attacker with valid credentials can send crafted HTTP requests to the Planning Analytics server. The server responds with HTTP responses that inadvertently disclose internal organizational structure details, such as department hierarchies or user roles. No special network position or additional privileges beyond standard user authentication are required.

Impact

Successful exploitation leads to information disclosure, revealing sensitive details about the organization's internal structure. This could aid an attacker in further targeted attacks or social engineering. The confidentiality of organizational data is compromised, but integrity and availability are not affected.

Mitigation

The vulnerability is fixed in IBM Planning Analytics Workspace Release 61 [1]. Users should upgrade to this version or later. There are no workarounds documented. The CVE is not listed in KEV.