CVE-2025-33004 - Vulnerability Details - OpenCVE

IBM Planning Analytics Local 2.0 and 2.1 could allow a privileged user to delete files from directories due to improper pathname restriction.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ibm	Planning Analytics Local

Configuration 1 [-]

OR	cpe:2.3:a:ibm:planning_analytics_local:2.0.0:::::::*
	cpe:2.3:a:ibm:planning_analytics_local:2.1.0:::::::*

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7235182

History

Mon, 02 Jun 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sun, 01 Jun 2025 11:45:00 +0000

Type	Values Removed	Values Added
Description		IBM Planning Analytics Local 2.0 and 2.1 could allow a privileged user to delete files from directories due to improper pathname restriction.
Title		IBM Planning Analytics Local path traversal
First Time appeared		Ibm Ibm planning Analytics Local
Weaknesses		CWE-22
CPEs		cpe:2.3:a:ibm:planning_analytics_local:2.0.0:::::::* cpe:2.3:a:ibm:planning_analytics_local:2.1.0:::::::*
Vendors & Products		Ibm Ibm planning Analytics Local
References		https://www.ibm.com/support/pages/node/7235182
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2025-06-01T11:37:51.426Z

Updated: 2025-06-02T03:19:08.871Z

Reserved: 2025-04-15T09:48:49.853Z

Link: CVE-2025-33004

Vulnrichment

Updated: 2025-06-02T03:19:05.551Z

NVD

Status : Analyzed

Published: 2025-06-01T12:15:25.643

Modified: 2025-06-09T18:08:21.600

Link: CVE-2025-33004

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-33004", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T09:48:49.853Z", "datePublished": "2025-06-01T11:37:51.426Z", "dateUpdated": "2025-06-02T03:19:08.871Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:planning_analytics_local:2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:planning_analytics_local:2.1.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Planning Analytics Local", "vendor": "IBM", "versions": [{"status": "affected", "version": "2.0, 2.1"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Planning Analytics Local 2.0 and 2.1 could allow a privileged user to delete files from directories due to improper pathname restriction."}], "value": "IBM Planning Analytics Local 2.0 and 2.1 could allow a privileged user to delete files from directories due to improper pathname restriction."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-06-01T11:37:51.426Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/7235182"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "It is strongly recommended that you apply the most recent security updates:<br><br>IBM Planning Analytics Local - IBM Planning Analytics Workspace 2.1 IBM Planning Analytics Local 2.1.11 is now available for download from Fix Central<br>IBM Planning Analytics Local - IBM Planning Analytics Workspace 2.0 Download IBM Planning Analytics Local v2.0: Planning Analytics Workspace Release 104 from Fix Central<br>"}], "value": "It is strongly recommended that you apply the most recent security updates:\n\nIBM Planning Analytics Local - IBM Planning Analytics Workspace 2.1 IBM Planning Analytics Local 2.1.11 is now available for download from Fix Central\nIBM Planning Analytics Local - IBM Planning Analytics Workspace 2.0 Download IBM Planning Analytics Local v2.0: Planning Analytics Workspace Release 104 from Fix Central"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Planning Analytics Local path traversal", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-02T03:18:57.621835Z", "id": "CVE-2025-33004", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-02T03:19:08.871Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "IBM Planning Analytics Local path traversal", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:planning_analytics_local:2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:planning_analytics_local:2.1.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Planning Analytics Local", "versions": [{"status": "affected", "version": "2.0, 2.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "It is strongly recommended that you apply the most recent security updates:\n\nIBM Planning Analytics Local - IBM Planning Analytics Workspace 2.1 IBM Planning Analytics Local 2.1.11 is now available for download from Fix Central\nIBM Planning Analytics Local - IBM Planning Analytics Workspace 2.0 Download IBM Planning Analytics Local v2.0: Planning Analytics Workspace Release 104 from Fix Central", "supportingMedia": [{"type": "text/html", "value": "It is strongly recommended that you apply the most recent security updates:<br><br>IBM Planning Analytics Local - IBM Planning Analytics Workspace 2.1 IBM Planning Analytics Local 2.1.11 is now available for download from Fix Central<br>IBM Planning Analytics Local - IBM Planning Analytics Workspace 2.0 Download IBM Planning Analytics Local v2.0: Planning Analytics Workspace Release 104 from Fix Central<br>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7235182", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM Planning Analytics Local 2.0 and 2.1 could allow a privileged user to delete files from directories due to improper pathname restriction.", "supportingMedia": [{"type": "text/html", "value": "IBM Planning Analytics Local 2.0 and 2.1 could allow a privileged user to delete files from directories due to improper pathname restriction.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-06-01T11:37:51.426Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-33004", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-02T03:18:57.621835Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2025-06-02T03:19:05.551Z"}}]}, "cveMetadata": {"cveId": "CVE-2025-33004", "state": "PUBLISHED", "dateUpdated": "2025-06-01T11:37:51.426Z", "dateReserved": "2025-04-15T09:48:49.853Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2025-06-01T11:37:51.426Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}