CVE-2023-42017: 
IBM Planning Analytics vulnerability analysis and mitigation

IBM Planning Analytics Local 2.0 contains a critical vulnerability (CVE-2023-42017) related to improper validation of file extensions. The vulnerability was discovered and disclosed on December 22, 2023, affecting IBM Planning Analytics Local version 2.0. This security flaw has received a CVSS v3.1 base score of 8.0 (High) from IBM Corporation and 9.8 (Critical) from NVD (NVD, IBM Security).

The vulnerability stems from insufficient validation of file extensions in the file upload functionality. When exploited, it allows remote attackers to upload malicious scripts through specially crafted HTTP requests. The severity assessment varies between sources, with IBM assigning a CVSS v3.1 Vector of AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (8.0) and NVD assigning AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). The vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type (NVD).

Successful exploitation of this vulnerability could allow attackers to execute arbitrary code on the vulnerable system. The impact affects all three key security aspects: confidentiality, integrity, and availability. The high severity ratings indicate that successful exploitation could lead to a complete compromise of the affected system (Cyber Security News).

IBM has released security updates to address this vulnerability. Users of IBM Planning Analytics Local 2.0 are strongly advised to apply the most recent security update. For IBM Planning Analytics Workspace, users should upgrade to Release 92, available from Fix Central. Cloud environments of IBM Planning Analytics Workspace have already been remediated (IBM Security).