PT-2022-12358 · Hitachi Vantara · Hitachi Vantara Pentaho Business Analytics Server

Published 2022-11-02 · Updated 2023-07-21 · CVE-2021-45446

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25

Description A vulnerability in Hitachi Vantara Pentaho Business Analytics Server does not cascade the hidden property to the children of the Home folder. This directory listing provides an attacker with the complete index of all the resources located inside the directory.

Recommendations For versions before 9.2.0.2, update to version 9.2.0.2 or later to resolve the issue. For versions before 8.3.0.25, update to version 8.3.0.25 or later to resolve the issue.

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

CWE-548

Related Identifiers

CVE-2021-45446

Affected Products

Hitachi Vantara Pentaho Business Analytics Server

References · 4

• https://support.pentaho.com/hc/en-us/articles/6744813983501 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45446 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45446 · Vendor Advisory
• https://t.me/cibsecurity/52472 · Telegram Post