PT-2021-20643 · Hitachi Vantara · Pentaho Business Analytics

Published 2021-11-08 · Updated 2021-11-09 · CVE-2021-34684

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics versions through 9.1

Description: The issue allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data source, thus enabling the retrieval of data from related databases. This is demonstrated by the "api/repos/dashboards/editor" URI, which is an API endpoint. The api/repos/dashboards/editor endpoint is vulnerable to this issue, allowing unauthorized access to sensitive data.

Recommendations: For Hitachi Vantara Pentaho Business Analytics versions through 9.1, consider restricting access to the api/repos/dashboards/editor API endpoint until a patch is available. As a temporary workaround, limit the execution of arbitrary SQL queries on Pentaho data sources to prevent unauthorized data retrieval.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-34684

Affected Products

Pentaho Business Analytics

References · 5

• 🔥 http://packetstormsecurity.com/files/164791/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-SQL-Injection.html · Exploit
• https://hitachi.com/hirt/security/index.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34684 · Security Note
• https://t.me/cibsecurity/31950 · Telegram Post