PT-2023-13514 · Hitachi Vantara · Pentaho Business Analytics Server

Published 2023-04-11 · Updated 2023-04-20 · CVE-2022-3695

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.3.0.0 Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.2.0.4 Hitachi Vantara Pentaho Business Analytics Server versions prior to 8.3.0.27

Description The issue allows a malicious URL to inject content into a dashboard when the CDE plugin is present.

Recommendations For versions prior to 9.3.0.0, update to version 9.3.0.0 or later. For versions prior to 9.2.0.4, update to version 9.2.0.4 or later. For versions prior to 8.3.0.27, update to version 8.3.0.27 or later. As a temporary workaround, consider disabling the CDE plugin until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-3695

Affected Products

Pentaho Business Analytics Server

References · 6

• https://support.pentaho.com/hc/en-us/articles/14739451011981 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3695 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3695 · Vendor Advisory
• https://t.me/cvenotify/48759 · Telegram Post
• https://t.me/cibsecurity/61903 · Telegram Post
• https://t.me/cvenotify/48011 · Telegram Post