PT-2023-13514 · Hitachi Vantara · Pentaho Business Analytics Server

CVE-2022-3695 · Publicado 2023-04-11 · Atualizado 2023-04-20

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.3.0.0 Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.2.0.4 Hitachi Vantara Pentaho Business Analytics Server versions prior to 8.3.0.27

Description The issue allows a malicious URL to inject content into a dashboard when the CDE plugin is present.

Recommendations For versions prior to 9.3.0.0, update to version 9.3.0.0 or later. For versions prior to 9.2.0.4, update to version 9.2.0.4 or later. For versions prior to 8.3.0.27, update to version 8.3.0.27 or later. As a temporary workaround, consider disabling the CDE plugin until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-3695

Produtos afetados

Pentaho Business Analytics Server

Referências · 6

• https://t.me/cvenotify/48759 · Publicação no Telegram
• https://t.me/cibsecurity/61903 · Publicação no Telegram
• https://support.pentaho.com/hc/en-us/articles/14739451011981 · Aviso do Fabricante
• https://t.me/cvenotify/48011 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-3695 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-3695 · Aviso do Fabricante