CVE-2023-42017

CVE-2023-42017 is a critical arbitrary file upload vulnerability affecting IBM Planning Analytics Local 2.0. An unauthenticated remote attacker can exploit improper file extension validation by sending a specially crafted HTTP request, allowing them to upload malicious scripts and achieve arbitrary code execution. This vulnerability carries a CVSS score of 9.8, indicating a severe risk with no user interaction required and complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, suggesting potential interest from threat actors.