High severity · published Jan 24, 2025
CVE-2024-25034
IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the type of file in the File Manager T1 process
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the type of file in the File Manager T1 process. Attackers can make use of this weakness and upload malicious executable files into the system that can be sent to victims for performing further attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Planning Analytics · Ibm
2.0; 2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-25034
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-25034
Vendor Advisory
https://www.ibm.com/support/pages/node/7168387
More from Planning Analytics
9.8
CVE-2019-4716
IBM Planning Analytics Remote Code Execution Vulnerability
9.8
CVE-2026-19622
IBM Planning Analytics Local is affected by security vulnerabilities
9.8
CVE-2023-42017
IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions
8.8
CVE-2026-76587
IBM Planning Analytics Buffer Overflow
8.8
CVE-2026-19620
IBM Planning Analytics Local is affected by security vulnerabilities