Security Bulletin: IBM Planning Analytics Workspace is affected by a vulnerability [CVE-2022-31129]

Summary

IBM Planning Analytics Workspace is affected by a vulnerability. Moment.js is a library used to parse, validate, manipulate, and display dates and times in JavaScript. This vulnerability has been addressed. [CVE-2022-31129]

Vulnerability Details

CVEID:CVE-2022-31129
**DESCRIPTION:**Moment is vulnerable to a denial of service, caused by inefficient regular expression complexity. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230690 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

IBM Planning Analytics Workspace 2.0

Remediation/Fixes

It is strongly recommended that you apply the most recent security update:

Download IBM Planning Analytics Local v2.0 - Planning Analytics Workspace Release 81 from Fix Central

This Security Bulletin is applicable to IBM Planning Analytics 2.0 on premise offerings. The vulnerability listed above has been addressed on IBM Planning Analytics with Watson and no further action is required.

Workarounds and Mitigations

None