PT-2021-11056 · Hitachi Vantara · Pentaho

Published 2021-01-29 · Updated 2021-02-04 · CVE-2020-24664

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho versions 7.x through 8.x

Description: The dashboard Editor in Hitachi Vantara Pentaho contains a reflected Cross-site scripting issue, allowing authenticated remote users to execute arbitrary JavaScript code. The vulnerability is specifically located in the pho:title attribute of the dashboardXml parameter.

Recommendations: For versions prior to 7.1.0.25, update to version 7.1.0.25 or later. For versions prior to 8.2.0.6, update to version 8.2.0.6 or later. For versions prior to 8.3.0.0 GA, update to version 8.3.0.0 GA or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-24664

Affected Products

Pentaho

References · 5

• https://osv.dev/vulnerability/CVE-2020-24664 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24664 · Security Note
• https://support.pentaho.com/hc/en-us/articles/360050965992-hirt-sec-2020-601-Multiple-Vulnerabilities-in-Pentaho · Vendor Advisory
• https://accenture.com · Note
• https://t.me/cibsecurity/22866 · Telegram Post