PT-2023-2232 · Hitachi Vantara · Pentaho Business Analytics Server+1

CVE-2022-43771 · Publicado 2023-04-03 · Atualizado 2023-04-10

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.4.0.0 Hitachi Vantara Pentaho Business Analytics Server version 9.3.0.1 and earlier Hitachi Vantara Pentaho Business Analytics Server versions 8.3.x

Description The issue is related to incorrect restriction of a directory path name with limited access. This can allow a remote attacker to gain unauthorized access to protected information. The Pentaho Data Access plugin exposes a service endpoint for CSV import, which allows a user-supplied path to access resources that are out of bounds.

Recommendations For versions prior to 9.4.0.0, update to version 9.4.0.0 or later. For version 9.3.0.1 and earlier, update to version 9.3.0.1 or later, or apply the necessary patch. For versions 8.3.x, consider disabling the Pentaho Data Access plugin until a patch is available, or restrict access to the CSV import service endpoint to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-01987

CVE-2022-43771

Produtos afetados

Pentaho Business Analytics Server

Pentaho Data Access

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-43771 · Nota de Segurança
• https://support.pentaho.com/hc/en-us/articles/14455007818509--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Limitation-of-a-Pathname-to-a-Restricted-Directory-Path-Traversal-Versions-before-9-4-0-0-and-9-3-0-1-including-8-3-x-Impacted-CVE-2022-43771- · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-01987 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-43771 · Aviso do Fabricante
• https://t.me/cibsecurity/61343 · Publicação no Telegram