IBM Planning Analytics Local vulnerabilities

IBM Planning Analytics Local versions 2.1.0 through 2.1.21 are vulnerable to an open redirect. An attacker can redirect users to arbitrary external websites via a crafted URL. If used in SSO flows, this could expose session tokens and allow session hijacking.

IBM Planning Analytics Local versions 2.1.0 through 2.1.14 allow a remote authenticated user to traverse directories on the system. An attacker can send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files.

IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code, which could be used in further attacks against the system.