PT-2021-19442 · Hitachi Vantara · Pentaho Business Intelligence Server+1

Published 2021-11-08 · Updated 2022-07-12 · CVE-2021-31602

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho versions through 9.1 Pentaho Business Intelligence Server versions through 7.x

Description An issue was discovered in the Security Model of the affected software, which has different layers of Access Control. One of these layers is the applicationContext security, defined in the applicationContext-spring-security.xml file. The default configuration allows an unauthenticated user with no previous knowledge of the platform settings to extract pieces of information without possessing valid credentials.

Recommendations For Hitachi Vantara Pentaho versions through 9.1, update the configuration of the applicationContext-spring-security.xml file to restrict access and require valid credentials for extracting information. For Pentaho Business Intelligence Server versions through 7.x, update the configuration of the applicationContext-spring-security.xml file to restrict access and require valid credentials for extracting information. As a temporary workaround, consider restricting access to the applicationContext security layer until a more permanent solution is implemented.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-31602

Affected Products

Hitachi Vantara Pentaho

Pentaho Business Intelligence Server

References · 5

• 🔥 http://packetstormsecurity.com/files/164784/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Authentication-Bypass.html · Exploit
• https://hitachi.com/hirt/security/index.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31602 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31602 · Security Note
• https://t.me/cibsecurity/31947 · Telegram Post