CVE-2024-35143

Published: Aug 4, 2024Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

IBM Planning Analytics Local 2.0 and 2.1 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is configured to allow connections without password authentication. A remote attacker can gain unauthorized access to the database. IBM X-Force ID: 292420.

Affected (4)

Products: Ibm: Planning Analytics Workspace, Planning Analytics Local

2 products

Planning Analytics Workspace

Planning Analytics Local

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Ibm Planning Analytics Workspace	From 2.0 to 2.0.97
Ibm Planning Analytics Workspace	From 2.1 to 2.1.4

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Ibm Planning Analytics Local	From 2.0 to 2.0.97
Ibm Planning Analytics Local	From 2.1.0 to 2.1.4

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://exchange.xforce.ibmcloud.com/vulnerabilities/292420

Source: psirt@us.ibm.com

Broken LinkVDB Entry

https://www.ibm.com/support/pages/node/7157110

Source: psirt@us.ibm.com

Vendor Advisory

Timeline

No history available yet.