Vulnerability Detail
Enriched intelligence for a single CVE
Critical
CVE-2019-4716
PUBLISHEDIBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and...
- Vendor
- IBM
- Product
- Planning Analytics
- Published
- Dec 18, 2019
- EPSS
- —
Automate This Intelligence with the Pro API
Everything on this page — CVSS, EPSS, exploit status, PoCs, scanner integrations, mentions, tags, and immediate honeypot data — is available programmatically for VM, SOC, and CTI workflows.
Description
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.
Weaknesses (CWE)
-
Improper Control of Generation of Code ('Code Injection')
CVSS Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/UI:N/AC:L/PR:N/I:H/S:C/AV:N/C:H/A:H/RC:C/RL:O/E:U
Exploitation Status
Exploited in the wild
Recorded 2021-11-03 00:00:00 UTC · CISA
Proof of concept available
Recorded 2025-04-28 15:02:27 UTC · Nuclei Templates
Known Exploited Vulnerability Sources
Catalogues that list this CVE as a known exploited vulnerability.
| Source | Added |
|---|---|
| CISA First | 2021-11-03 00:00 UTC |
Scanner Integrations
| Scanner | Reference | Detected |
|---|---|---|
| Nuclei | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-4716.yaml | Jun 01, 2026 |
| Metasploit | https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | Apr 28, 2025 |
Potential Proof of Concepts
These PoCs are unverified and could contain malware. Use at your own risk.
nuclei · Created Unknown
Timeline
-
Detected by Nuclei
-
Detected by Metasploit
-
Proof of Concept Exploit Available
-
Added to KEVIntel
-
CVE Published to Public
-
CVE ID Reserved