CVE-2025-36299

IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7251265	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:planning_analytics_local::::::::
	cpe:2.3:a:ibm:planning_analytics_workspace::::::::

History

07 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) IBM Planning Analytics Local 2.1.0 hasta 2.1.14 almacena información sensible en el código fuente que podría ser utilizada en ataques posteriores contra el sistema.

Information

Published : 2025-11-17 20:15

Updated : 2026-10-07 21:10

NVD link : CVE-2025-36299

Mitre link : CVE-2025-36299

CVE.ORG link : CVE-2025-36299

JSON object : View

Products Affected

ibm

planning_analytics_workspace
planning_analytics_local

CWE

CWE-540

Inclusion of Sensitive Information in Source Code

{"id": "CVE-2025-36299", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36299", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-17T20:52:21.524173Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:planning_analytics_local:2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:planning_analytics_local:2.1.14:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "IBM Planning Analytics Local", "versions": [{"status": "affected", "version": "2.1.0", "versionType": "semver", "lessThanOrEqual": "2.1.14"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-17T20:15:51.280", "references": [{"url": "https://www.ibm.com/support/pages/node/7251265", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-540"}]}], "descriptions": [{"lang": "en", "value": "IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system."}, {"lang": "es", "value": "IBM Planning Analytics Local 2.1.0 hasta 2.1.14 almacena informaci\u00f3n sensible en el c\u00f3digo fuente que podr\u00eda ser utilizada en ataques posteriores contra el sistema."}], "lastModified": "2026-10-07T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:planning_analytics_local:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E47A024C-E323-42C2-AECE-A22FC40E4F24", "versionEndExcluding": "2.1.15", "versionStartIncluding": "2.1.0"}, {"criteria": "cpe:2.3:a:ibm:planning_analytics_workspace:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66FACACB-88F0-471E-A582-30FED23C668B", "versionEndExcluding": "2.1.15", "versionStartIncluding": "2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}