CVE-2024-35143
Ibm
CVE-2024-35143: Unauthenticated access to MongoDB in IBM Planning Analytics Local. This vulnerability allows a remote attacker to gain unauthorized access to the database due to missing password authentication.
CVE-2024-35143 affects IBM Planning Analytics Local versions 2.0 and 2.1, where the MongoDB server is exposed without password protection. This permits unauthorized remote connections, potentially leading to data breaches and system compromise. The CVSS score is 9.1 indicating critical severity, but the SOCRadar Vulnerability Risk Score (SVRS) is 30, suggesting a lower immediate threat level despite the inherent risk. Although the SVRS is low, the absence of authentication remains a significant security flaw. Immediate action is still required to implement authentication mechanisms and secure the MongoDB instance to prevent exploitation.
Description
CVE-2024-35143 is a vulnerability in IBM Planning Analytics Local 2.0 and 2.1 that allows a remote attacker to gain unauthorized access to the MongoDB database due to a lack of password authentication. The SVRS score of 46 indicates a moderate risk, highlighting the need for attention and appropriate mitigation measures.
Key Insights
- Unprotected MongoDB Database: The vulnerability stems from the MongoDB database being accessible remotely without password protection, making it susceptible to unauthorized access and potential data breaches.
- Remote Exploitation: Attackers can exploit this vulnerability remotely, increasing the risk of compromise for organizations with exposed MongoDB databases.
- Data Theft and Manipulation: Unauthorized access to the database could lead to data theft, manipulation, or disruption, potentially impacting business operations and sensitive information.
Mitigation Strategies
- Enable Password Authentication: Implement strong password authentication for the MongoDB database to prevent unauthorized access.
- Restrict Network Access: Limit network access to the database to authorized users and devices to minimize the risk of remote exploitation.
- Monitor and Audit: Regularly monitor and audit database activity to detect any suspicious or unauthorized access attempts.
- Update Software: Apply the latest software updates and patches to address any known vulnerabilities and enhance overall security.
Additional Information
- Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
- Exploit Status: Active exploits have not been published.
- CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
- In the Wild: There is no evidence that this vulnerability is currently being exploited in the wild.
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.