CVE-2020-4527: 
IBM Planning Analytics vulnerability analysis and mitigation

IBM Planning Analytics Administration was affected by a security vulnerability (CVE-2020-4527) that was disclosed on July 20, 2020. The vulnerability affected IBM Planning Analytics Local v2.0, specifically the Planning Analytics Workspace component (IBM Security).

The vulnerability stems from a failure to set the Secure flag for the session cookie in TLS mode. The vulnerability has been assigned a CVSS Base score of 5.9 with a vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (IBM Security).

By intercepting transmission within an HTTP session, an attacker could potentially capture the cookie and obtain sensitive information from the IBM Planning Analytics Administration system (IBM Security).

The vulnerability requires network access and high attack complexity, with no privileges or user interaction required. However, the scope is unchanged, with potential for high confidentiality impact but no impact on integrity or availability (IBM Security).

IBM has addressed this vulnerability in IBM Planning Analytics Local v2.0 - Planning Analytics Workspace Release 54. The recommended solution is to apply this fix as soon as practical. Users can download IBM Planning Analytics Local v2.0 - Planning Analytics Workspace Release 54 from Fix Central (IBM Security).