PT-2023-15592 · Hitachi Vantara · Pentaho Business Analytics Server

Clarence Liau · Publicado 2023-05-24 · Atualizado 2023-06-01 · CVE-2022-4815

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pentaho Business Analytics Server versions prior to 9.4.0.1 Pentaho Business Analytics Server versions prior to 9.3.0.3 Pentaho Business Analytics Server version 8.3.x

Description The issue concerns the deserialization of untrusted JSON data without proper constraints on the parser, allowing it to access unapproved classes and methods.

Recommendations For versions prior to 9.4.0.1, update to version 9.4.0.1 or later. For versions prior to 9.3.0.3, update to version 9.3.0.3 or later. For version 8.3.x, consider upgrading to a newer version that includes the necessary security fixes, as version 8.3.x is affected.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2022-4815

Produtos afetados

Pentaho Business Analytics Server

Referências · 3

• https://support.pentaho.com/hc/en-us/articles/14455879270285-IMPORTANT-Resolved-Pentaho-BA-Server-Deserialization-of-Untrusted-Data-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2022-4815- · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-4815 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-4815 · Aviso do Fabricante