Wiz
Vulnerability DatabaseCVE-2021-29852

CVE-2021-29852: 
IBM Planning Analytics vulnerability analysis and mitigation

Overview

IBM Planning Analytics is vulnerable to cross-site scripting (CVE-2021-29852). This vulnerability affects IBM Planning Analytics Local v2.0 - Planning Analytics Workspace and allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session. The vulnerability was disclosed and patched in August 2021 (IBM Support).

Technical details

The vulnerability has a CVSS Base score of 5.4 with a vector of (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction. The scope is changed with low confidentiality and integrity impact, and no availability impact (IBM Support).

Impact

The vulnerability allows attackers to alter the intended functionality of the web interface by injecting malicious JavaScript code. This could potentially lead to the disclosure of user credentials within a trusted session (IBM Support).

Mitigation and workarounds

IBM has released a security update to address this vulnerability. The recommended solution is to apply IBM Planning Analytics Local v2.0 - Planning Analytics Workspace Release 67, which can be downloaded from Fix Central. For IBM Planning Analytics with Watson, the vulnerability has already been addressed and no further action is required (IBM Support).

Additional resources

Source: This report was generated using AI

Related IBM Planning Analytics vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2023-42017CRITICAL9.8
  • IBM Planning AnalyticsIBM Planning Analytics
  • cpe:2.3:a:ibm:planning_analytics
NoYesDec 22, 2023
CVE-2024-25034HIGH8.8
  • IBM Planning AnalyticsIBM Planning Analytics
  • cpe:2.3:a:ibm:planning_analytics
NoYesJan 24, 2025
CVE-2024-40693HIGH8
  • IBM Planning AnalyticsIBM Planning Analytics
  • cpe:2.3:a:ibm:planning_analytics
NoYesJan 24, 2025
CVE-2022-22339HIGH7.3
  • IBM Planning AnalyticsIBM Planning Analytics
  • cpe:2.3:a:ibm:planning_analytics
NoYesApr 08, 2022
CVE-2021-39047MEDIUM6.1
  • IBM Planning AnalyticsIBM Planning Analytics
  • cpe:2.3:a:ibm:planning_analytics
NoYesJun 24, 2022

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo