CVE-2025-36437
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
IBM Planning Analytics Local 2.1.0 through 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system.
Risk Assessment
Disclosure of server architecture details may help an attacker plan more effective attacks. This could increase the risk of system compromise.
Recommendation
Update IBM Planning Analytics Local to a version later than 2.1.15. Restrict access to the system and monitor for unusual activity.
Other vulnerabilities in IBM Planning Analytics Local
See all- CVE-2026-10545High
IBM Planning Analytics Local versions 2.1.0 through 2.1.21 are vulnerable to an open redirect. An attacker can redirect users to arbitrary external websites via a crafted URL. If used in SSO flows, this could expose session tokens and allow session hijacking.
- CVE-2025-36357High
IBM Planning Analytics Local versions 2.1.0 through 2.1.14 allow a remote authenticated user to traverse directories on the system. An attacker can send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files.
- CVE-2025-36299Medium
IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code, which could be used in further attacks against the system.
Original NVD description (English source)
IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS