CVE-2020-4562: 
IBM Planning Analytics vulnerability analysis and mitigation

IBM Planning Analytics 2.0 contains a security vulnerability (CVE-2020-4562) that could allow a remote attacker to obtain sensitive information through cross-window communication with unrestricted target origin via documentation frames. The vulnerability was disclosed and addressed in IBM Planning Analytics Local v2.0 - Planning Analytics Workspace Release 63 (IBM Advisory).

The vulnerability has been assigned a CVSS Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability is network exploitable (AV:N) with low attack complexity (AC:L), requires no privileges (PR:N) or user interaction (UI:N), has unchanged scope (S:U), and can result in low confidentiality impact (C:L) with no impact on integrity (I:N) or availability (A:N) (IBM Advisory, NVD).

The vulnerability allows remote attackers to obtain sensitive information by exploiting unrestricted cross-window communication through documentation frames (IBM Advisory).

The vulnerability is network accessible and requires no special privileges or user interaction to exploit, making it relatively straightforward for potential attackers to leverage (NVD).

IBM recommends applying IBM Planning Analytics Local v2.0 - Planning Analytics Workspace Release 63 as soon as practical. For IBM Planning Analytics Cloud users, the vulnerability has already been addressed and no further action is required. No workarounds or alternative mitigations are available (IBM Advisory).