CVE-2025-36132 - Vulnerability Details - OpenCVE

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00026.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ibm	Planning Analytics Local

No data.

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7246602

History

Tue, 30 Sep 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 30 Sep 2025 19:45:00 +0000

Type	Values Removed	Values Added
Description		IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Title		IBM Planning Analytics Local cross-site scripting
First Time appeared		Ibm Ibm planning Analytics Local
Weaknesses		CWE-79
CPEs		cpe:2.3:a:ibm:planning_analytics_local:2.0.0:::::::* cpe:2.3:a:ibm:planning_analytics_local:2.0.106:::::::* cpe:2.3:a:ibm:planning_analytics_local:2.1.0:::::::* cpe:2.3:a:ibm:planning_analytics_local:2.1.13:::::::*
Vendors & Products		Ibm Ibm planning Analytics Local
References		https://www.ibm.com/support/pages/node/7246602
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2025-09-30T19:41:19.912Z

Updated: 2025-09-30T20:40:56.983Z

Reserved: 2025-04-15T21:16:19.007Z

Link: CVE-2025-36132

Vulnrichment

Updated: 2025-09-30T20:40:46.889Z

NVD

Status : Awaiting Analysis

Published: 2025-09-30T20:15:37.810

Modified: 2025-10-02T19:12:17.160

Link: CVE-2025-36132

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-36132", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:19.007Z", "datePublished": "2025-09-30T19:41:19.912Z", "dateUpdated": "2025-09-30T20:40:56.983Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:planning_analytics_local:2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:planning_analytics_local:2.0.106:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:planning_analytics_local:2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:planning_analytics_local:2.1.13:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Planning Analytics Local", "vendor": "IBM", "versions": [{"lessThanOrEqual": "2.0.106", "status": "affected", "version": "2.0.0", "versionType": "semver"}, {"lessThanOrEqual": "2.1.13", "status": "affected", "version": "2.1.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."}], "value": "IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-09-30T19:41:19.912Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7246602"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>It is strongly recommended that you apply the most recent security updates:</div><div> </div><div><div><table><tbody><tr><td>Affected Product(s)</td><td>Version</td><td>Fix</td></tr><tr><td>IBM Planning Analytics Local - IBM Planning Analytics Workspace</td><td>2.1.0 - 2.1.13</td><td><span style=\"background-color: rgb(255, 255, 255);\"><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7245803\">IBM Planning Analytics Local 2.1.14 is now available for download from Fix Central</a></span></td></tr><tr><td>IBM Planning Analytics Local - IBM Planning Analytics Workspace</td><td>2.0.0 - 2.0.106</td><td><span style=\"background-color: rgb(255, 255, 255);\"><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7245802\">Download IBM Planning Analytics Local v2.0: Planning Analytics Workspace Release 107 from Fix Central</a></span></td></tr></tbody></table></div><p>IBM Planning Analytics Cloud and Planning Analytics as a Service environments have been remediated.</p></div>\n\n<br>"}], "value": "It is strongly recommended that you apply the most recent security updates:\n\n\u00a0\n\nAffected Product(s)VersionFixIBM Planning Analytics Local - IBM Planning Analytics Workspace2.1.0 - 2.1.13 IBM Planning Analytics Local 2.1.14 is now available for download from Fix Central https://www.ibm.com/support/pages/node/7245803 IBM Planning Analytics Local - IBM Planning Analytics Workspace2.0.0 - 2.0.106 Download IBM Planning Analytics Local v2.0: Planning Analytics Workspace Release 107 from Fix Central https://www.ibm.com/support/pages/node/7245802 \n\nIBM Planning Analytics Cloud and Planning Analytics as a Service environments have been remediated."}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Planning Analytics Local cross-site scripting", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-30T20:40:44.953064Z", "id": "CVE-2025-36132", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T20:40:56.983Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36132", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-30T20:40:44.953064Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T20:40:46.889Z"}}], "cna": {"title": "IBM Planning Analytics Local cross-site scripting", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:planning_analytics_local:2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:planning_analytics_local:2.0.106:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:planning_analytics_local:2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:planning_analytics_local:2.1.13:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Planning Analytics Local", "versions": [{"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "2.0.106"}, {"status": "affected", "version": "2.1.0", "versionType": "semver", "lessThanOrEqual": "2.1.13"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "It is strongly recommended that you apply the most recent security updates:\n\n\u00a0\n\nAffected Product(s)VersionFixIBM Planning Analytics Local - IBM Planning Analytics Workspace2.1.0 - 2.1.13 IBM Planning Analytics Local 2.1.14 is now available for download from Fix Central https://www.ibm.com/support/pages/node/7245803 IBM Planning Analytics Local - IBM Planning Analytics Workspace2.0.0 - 2.0.106 Download IBM Planning Analytics Local v2.0: Planning Analytics Workspace Release 107 from Fix Central https://www.ibm.com/support/pages/node/7245802 \n\nIBM Planning Analytics Cloud and Planning Analytics as a Service environments have been remediated.", "supportingMedia": [{"type": "text/html", "value": "<div>It is strongly recommended that you apply the most recent security updates:</div><div> </div><div><div><table><tbody><tr><td>Affected Product(s)</td><td>Version</td><td>Fix</td></tr><tr><td>IBM Planning Analytics Local - IBM Planning Analytics Workspace</td><td>2.1.0 - 2.1.13</td><td><span style=\"background-color: rgb(255, 255, 255);\"><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7245803\">IBM Planning Analytics Local 2.1.14 is now available for download from Fix Central</a></span></td></tr><tr><td>IBM Planning Analytics Local - IBM Planning Analytics Workspace</td><td>2.0.0 - 2.0.106</td><td><span style=\"background-color: rgb(255, 255, 255);\"><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7245802\">Download IBM Planning Analytics Local v2.0: Planning Analytics Workspace Release 107 from Fix Central</a></span></td></tr></tbody></table></div><p>IBM Planning Analytics Cloud and Planning Analytics as a Service environments have been remediated.</p></div>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7246602", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.", "supportingMedia": [{"type": "text/html", "value": "IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-09-30T19:41:19.912Z"}}}, "cveMetadata": {"cveId": "CVE-2025-36132", "state": "PUBLISHED", "dateUpdated": "2025-09-30T20:40:56.983Z", "dateReserved": "2025-04-15T21:16:19.007Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2025-09-30T19:41:19.912Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}