PT-2022-12360 · Pentaho · Pentaho Analyzer Plugin+1

Published 2022-11-02 · Updated 2022-11-04 · CVE-2021-45448

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25

Description The issue allows a user-supplied path to access resources that are out of bounds, due to the software's failure to properly neutralize special elements within the pathname. This can cause the pathname to resolve to a location outside of the restricted directory. Attackers can exploit this by using special elements such as .. and / separators to escape outside of the restricted location and access files or directories elsewhere on the system.

Recommendations For versions before 9.2.0.2, update to version 9.2.0.2 or later. For versions before 8.3.0.25, update to version 8.3.0.25 or later. As a temporary workaround, consider restricting access to the service endpoint for templates in the Pentaho Analyzer plugin until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-45448

Affected Products

Pentaho Analyzer Plugin

Pentaho Business Analytics Server

References · 4

• https://osv.dev/vulnerability/CVE-2021-45448 · Vendor Advisory
• https://support.pentaho.com/hc/en-us/articles/6744743458701 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45448 · Security Note
• https://t.me/cibsecurity/52489 · Telegram Post