PT-2023-14316 · Hitachi Vantara · Pentaho Business Analytics Server

CVE-2022-43770 · Publicado 2023-04-11 · Atualizado 2023-04-20

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0 Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.4 Hitachi Vantara Pentaho Business Analytics Server versions before 8.3.0.27

Description The issue is related to an authorization check in the dashboard editor plugin API, which is not performed correctly.

Recommendations For versions before 9.3.0.0, update to version 9.3.0.0 or later. For versions before 9.2.0.4, update to version 9.2.0.4 or later. For versions before 8.3.0.27, update to version 8.3.0.27 or later.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2022-43770

Produtos afetados

Pentaho Business Analytics Server

Referências · 5

• https://osv.dev/vulnerability/CVE-2022-43770 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-43770 · Nota de Segurança
• https://support.pentaho.com/hc/en-us/articles/14739303079053 · Aviso do Fabricante
• https://t.me/cibsecurity/61896 · Publicação no Telegram
• https://t.me/cvenotify/48010 · Publicação no Telegram