High severity · published Jan 24, 2025
CVE-2024-40693
IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface
8.0
CVSS
0.4%
EPSS
No
On KEV
Description
IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Planning Analytics · Ibm
2.0; 2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-40693
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-40693
Vendor Advisory
https://www.ibm.com/support/pages/node/7168387
More from Planning Analytics
9.8
CVE-2019-4716
IBM Planning Analytics Remote Code Execution Vulnerability
9.8
CVE-2026-19622
IBM Planning Analytics Local is affected by security vulnerabilities
9.8
CVE-2023-42017
IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions
8.8
CVE-2026-76587
IBM Planning Analytics Buffer Overflow
8.8
CVE-2026-19620
IBM Planning Analytics Local is affected by security vulnerabilities