Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMFC15FB89A35157F2AD2EE30021853408CDD65CF9CAD42A35F5E26F9054836AB4
HistoryMay 24, 2023 - 10:07 p.m.

Security Bulletin: IBM Planning Analytics Workspace has addressed a vulnerability in SnakeYaml (CVE-2022-1471)

2023-05-2422:07:18
www.ibm.com
17
ibm planning analytics
snakeyaml
rce
vulnerability
upgrade
security update
mitigation

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.022 Low

EPSS

Percentile

89.4%

JSON

Summary

IBM Planning Analytics Workspace is vulnerable to a Remote Code Execution (RCE) in SnakeYaml. SnakeYaml has been upgraded in IBM Planning Analytics Workspace.

Vulnerability Details

CVEID:CVE-2022-1471
**DESCRIPTION:**SnakeYaml could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in the Constructor class. By using a specially-crafted yaml content, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 8.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241118 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Planning Analytics Workspace 2.0

Remediation/Fixes

It is strongly recommended that you apply the most recent security update:

Product(s) Versions(s) Remediation/Fix/Instructions
IBM Planning Analytics Workspace 2.0 Download IBM Planning Analytics Local v2.0: Planning Analytics Workspace Release 87 from Fix Central

This Security Bulletin is applicable to IBM Planning Analytics 2.0 on premise offerings. The vulnerabilities listed above has been addressed on IBM Planning Analytics with Watson and no further action is required.

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmplanning_analytics_localMatchany
CPENameOperatorVersion
ibm planning analytics localeqany

Related

cgr 1
hackerone 1
f5 1
oraclelinux 1
nessus 25
cve 2
atlassian 4
ibm 48
osv 7
redos 1
cvelist 2
debiancve 1
rocky 2
nvd 2
veracode 1
redhat 29
almalinux 1
ubuntucve 1
redhatcve 1
prion 2
github 2
githubexploit 1
zdt 1
packetstorm 1
metasploit 1
rapid7blog 1
thn 2
hivepro 1
qualysblog 5
oracle 5
cgr
cgr
CVE-2022-1471 vulnerabilities
2024-04-30 09:06:13
hackerone
hackerone
Kubernetes: The `io.kubernetes.client.util.generic.dynamic.Dynamics` contains a code execution vulnerability due to SnakeYAML
2022-12-15 19:07:04
f5
f5
K000132638 : SnakeYAML vulnerability CVE-2022-1471
2023-02-16 00:00:00
oraclelinux
oraclelinux
prometheus-jmx-exporter security update
2022-12-15 00:00:00
nessus
nessus
Rocky Linux 8 : prometheus-jmx-exporter (RLSA-2022:9058)
2023-01-30 00:00:00
Oracle Linux 8 : ELSA-2022-9058-1: / prometheus-jmx-exporter (ELSA-2022-90581)
2022-12-15 00:00:00
Atlassian Confluence 6.13.x < 7.13.18 / 7.14.x < 7.19.10 / 7.20.x < 8.3.1 (CONFSERVER-91463)
2023-12-13 00:00:00
cve
cve
CVE-2022-1471
2022-12-01 11:15:10
CVE-2023-46302
2023-11-20 09:15:07
atlassian
atlassian
RCE (Remote Code Execution) in - CVE-2022-1471
2023-10-08 08:44:33
RCE (Remote Code Execution) in Bitbucket Data Center and Server - CVE-2022-1471
2023-09-19 20:41:22
RCE (Remote Code Execution) in Confluence Data Center and Server - CVE-2022-1471
2023-09-11 21:13:51
ibm
ibm
Security Bulletin: IBM Db2 Web Query for i is vulnerable to arbitrary code execution due to SnakeYaml [CVE-2022-1471]
2023-07-19 20:29:29
Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to execution of arbitrary code on the system (CVE-2022-1471)
2023-07-17 14:27:18
Security Bulletin: IBM Workload Scheduler potentially affected by a vulnerability in SnakeYaml (CVE-2022-1471)
2023-06-13 13:09:52
osv
osv
CVE-2022-1471
2022-12-01 11:15:10
Important: prometheus-jmx-exporter security update
2022-12-15 15:08:09
Important: prometheus-jmx-exporter security update
2022-12-15 00:00:00
redos
redos
ROS-20240514-03
2024-05-14 00:00:00
cvelist
cvelist
CVE-2022-1471 Remote Code execution in SnakeYAML
2022-12-01 10:47:07
CVE-2023-46302 Apache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserialization
2023-11-20 08:46:56
debiancve
debiancve
CVE-2022-1471
2022-12-01 11:15:10
rocky
rocky
prometheus-jmx-exporter security update
2022-12-15 15:08:09
Satellite 6.13 Release
2023-05-05 15:39:58
nvd
nvd
CVE-2022-1471
2022-12-01 11:15:10
CVE-2023-46302
2023-11-20 09:15:07
veracode
veracode
Remote Code Execution (RCE)
2022-12-02 17:22:00
redhat
redhat
(RHSA-2022:9058) Important: prometheus-jmx-exporter security update
2022-12-15 15:08:09
(RHSA-2023:0697) Important: OpenShift Container Platform 4.10.52 security update
2023-02-15 15:39:07
(RHSA-2022:9032) Important: Red Hat build of Eclipse Vert.x 4.3.4 security update
2022-12-15 12:38:08
almalinux
almalinux
Important: prometheus-jmx-exporter security update
2022-12-15 00:00:00
ubuntucve
ubuntucve
CVE-2022-1471
2022-12-01 00:00:00
redhatcve
redhatcve
CVE-2022-1471
2022-12-01 15:56:23
prion
prion
Deserialization of untrusted data
2022-12-01 11:15:00
Design/Logic Flaw
2023-11-20 09:15:00
github
github
SnakeYaml Constructor Deserialization Remote Code Execution
2022-12-12 21:19:47
Deserialization of Untrusted Data in apache-submarine
2023-11-20 09:30:31
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Snakeyaml Project Snakeyaml
2023-03-02 16:33:02
zdt
zdt
PyTorch Model Server Registration / Deserialization Remote Code Execution Exploit
2023-10-15 00:00:00
packetstorm
packetstorm
PyTorch Model Server Registration / Deserialization Remote Code Execution
2023-10-13 00:00:00
metasploit
metasploit
PyTorch Model Server Registration and Deserialization RCE
2023-10-12 13:27:26
rapid7blog
rapid7blog
Metasploit Weekly Wrap-Up
2023-10-13 17:03:36
thn
thn
Warning: PyTorch Models Vulnerable to Remote Code Execution via ShellTorch
2023-10-03 16:24:00
Atlassian Releases Critical Software Fixes to Prevent Remote Code Execution
2023-12-06 09:18:00
hivepro
hivepro
Atlassian Addresses Critical RCE Flaws
2023-12-07 12:45:52
qualysblog
qualysblog
Oracle Patch Update, April 2024 Security Update Review
2024-04-17 14:39:59
Oracle Patch Update, January 2024 Security Update Review
2024-01-17 15:29:33
Oracle Patch Tuesday April 2023 Security Update Review
2023-04-19 11:47:21
oracle
oracle
Oracle Critical Patch Update Advisory - January 2024
2024-01-16 00:00:00
Oracle Critical Patch Update Advisory - October 2023
2023-10-17 00:00:00
Oracle Critical Patch Update Advisory - July 2023
2023-07-18 00:00:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.022 Low

EPSS

Percentile

89.4%

JSON
Related for FC15FB89A35157F2AD2EE30021853408CDD65CF9CAD42A35F5E26F9054836AB4
cgr1hackerone1f51oraclelinux1nessus25cve2atlassian4ibm48osv7redos1cvelist2debiancve1rocky2nvd2veracode1redhat29almalinux1ubuntucve1redhatcve1prion2github2githubexploit1zdt1packetstorm1metasploit1rapid7blog1thn2hivepro1qualysblog5oracle5