CVE-2023-27877 MEDIUM

CVE-2023-27877: IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosure

Vendor Ibm
Product Planning Analytics Cartridge for Cloud Pak for Data
Weakness CWE-200 · Info exposure
Published July 19, 2023
Last update October 28, 2024
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB server and collect sensitive information from the database. IBM X-Force ID: 247905.

Key dates

02Disclosure timeline

July 19, 2023 CVE published
October 28, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-52323 Sensitive Data Exposure CVE-2024-12575 Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.8.9 - Unauthenticated Basic Information Exposure CVE-2024-11265 Wp Maximum Upload File Size <= 1.1.3 - Authenticated (Author+) Full Path Disclosure CVE-2025-12297 atjiu pybbs UserApiController.java information disclosure CVE-2020-12518 Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.