Vulnerabilities

TI-2021-20537 CVE-2021-45448 · GHSA-6rjj-325g-5j42

Path traversal in Hitachi Vantara Pentaho Business Analytics Server

LOW 32

Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user-supplied path to access resources that are out of boun…

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00676 Published 2022-11-02 Fixed in 9.2.0.2, 8.3.0.25 CWE-22

TI-2021-20536 CVE-2021-45447 · GHSA-3j5x-8vq5-wc5h

Cleartext transmission of sensitive information in Hitachi Vantara Pentaho Business…

LOW 34

Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and 8.3.0.25 with the Data Lineage feature enabled transmits database passwords in clear text.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.00364 Published 2022-11-02 Fixed in 9.2.0.2, 8.3.0.25 CWE-319

TI-2021-20535 CVE-2021-45446 · GHSA-jgwp-h4gx-xm93

Pentaho Business Analytics Server - Exposure of Information Through Directory Listing

LOW 33

A vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 does not cascade the hidden property to the children of the Home folder.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00506 Published 2022-11-02 Fixed in 8.3.0.25, 9.2.0.2 CWE-548

Vulnerabilities

Filters

Path traversal in Hitachi Vantara Pentaho Business Analytics Server

Cleartext transmission of sensitive information in Hitachi Vantara Pentaho Business…

Pentaho Business Analytics Server - Exposure of Information Through Directory Listing