Hitachi
Hitachi Vantara Pentaho Business Analytics Server: vulnerabilidades y CVE
Hitachi Vantara Pentaho Business Analytics Server tiene 14 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 1 son críticas y 2 figuran en el catálogo de explotación activa de CISA.
CVE14
Últimos 12 meses0
Críticas1
Explotadas activamente2
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2022-43769 | Alta (7.2) | 98% | ⚠ Explotación activa | 3 abr 2023 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream. |
| CVE-2022-43939 | Crítica (9.8) | 92% | ⚠ Explotación activa | 3 abr 2023 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented. |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2023-1158 | Media (4.3) | 0.38% | — | 24 may 2023 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list. |
| CVE-2022-4815 | Alta (8.8) | 0.63% | — | 24 may 2023 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods. |
| CVE-2022-4771 | Media (6.1) | 0.35% | — | 3 abr 2023 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow a malicious URL to inject content into the Pentaho User Console through session variables. |
| CVE-2022-4770 | Media (4.3) | 0.43% | — | 3 abr 2023 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho… |
| CVE-2022-4769 | Media (4.3) | 0.43% | — | 3 abr 2023 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploaded with an invalid character in its name. |
| CVE-2022-43941 | Media (6.5) | 0.53% | — | 3 abr 2023 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML… |
| CVE-2022-43940 | Alta (8.8) | 0.56% | — | 3 abr 2023 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the data source management service. |
| CVE-2022-43939 | Crítica (9.8) | 92% | ⚠ Explotación activa | 3 abr 2023 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented. |
| CVE-2022-43938 | Alta (8.8) | 26% | — | 3 abr 2023 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM… |
| CVE-2022-43772 | Media (6.5) | 0.39% | — | 3 abr 2023 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs. |
| CVE-2022-43771 | Media (6.5) | 24% | — | 3 abr 2023 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to… |
| CVE-2022-3960 | Media (6.3) | 0.45% | — | 3 abr 2023 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE)… |
| CVE-2022-43773 | Alta (8.8) | 22% | — | 3 abr 2023 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configured with stored procedures enabled. |
| CVE-2022-43769 | Alta (7.2) | 98% | ⚠ Explotación activa | 3 abr 2023 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.
Otros productos de Hitachi
Device Manager · 18OPS Center Analyzer · 17Vantara Pentaho · 16Ucosminexus Service Platform · 13Infrastructure Analytics Advisor · 13Tuning Manager · 10Ucosminexus Application Server Enterprise · 9Ucosminexus Application Server Standard · 9Groupmax Collaboration Portal · 8Ucosminexus Service Architect · 8Replication Manager · 7Groupmax Collaboration WEB Client · 7