CVE-2025-36299: IBM Planning Analytics Information Disclosure
Published Nov 17, 2025
·Updated
IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system.
Affected Software
3 affected components
IBM Planning Analytics Local>=2.1.0<=2.1.14
IBM Planning Analytics Local>=2.1.0<2.1.15
IBM Planning Analytics Workspace>=2.1.0<2.1.15
Event History
Nov 17, 2025
CVE Published
via MITRE·08:09 PM
Data Sourced
via MITRE·08:09 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-36299?
CVE-2025-36299 has a medium severity rating due to the exposure of sensitive information in the source code.
2
How do I fix CVE-2025-36299?
To fix CVE-2025-36299, upgrade IBM Planning Analytics Local to version 2.1.15 or later.
3
What information is stored insecurely in CVE-2025-36299?
CVE-2025-36299 allows sensitive data to be stored in the source code, which could be exploited in future attacks.
4
Which versions of IBM Planning Analytics Local are affected by CVE-2025-36299?
Versions 2.1.0 through 2.1.14 of IBM Planning Analytics Local are affected by CVE-2025-36299.
5
Can CVE-2025-36299 be exploited remotely?
CVE-2025-36299 can potentially be exploited by attackers with access to the vulnerable software's source code.