PT-2023-14316 · Hitachi Vantara · Pentaho Business Analytics Server

Published 2023-04-11 · Updated 2023-04-20 · CVE-2022-43770

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0 Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.4 Hitachi Vantara Pentaho Business Analytics Server versions before 8.3.0.27

Description The issue is related to an authorization check in the dashboard editor plugin API, which is not performed correctly.

Recommendations For versions before 9.3.0.0, update to version 9.3.0.0 or later. For versions before 9.2.0.4, update to version 9.2.0.4 or later. For versions before 8.3.0.27, update to version 8.3.0.27 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-43770

Affected Products

Pentaho Business Analytics Server

References · 5

• https://osv.dev/vulnerability/CVE-2022-43770 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43770 · Security Note
• https://support.pentaho.com/hc/en-us/articles/14739303079053 · Vendor Advisory
• https://t.me/cibsecurity/61896 · Telegram Post
• https://t.me/cvenotify/48010 · Telegram Post