PT-2023-15592 · Hitachi Vantara · Pentaho Business Analytics Server

Clarence Liau · Published 2023-05-24 · Updated 2023-06-01 · CVE-2022-4815

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pentaho Business Analytics Server versions prior to 9.4.0.1 Pentaho Business Analytics Server versions prior to 9.3.0.3 Pentaho Business Analytics Server version 8.3.x

Description The issue concerns the deserialization of untrusted JSON data without proper constraints on the parser, allowing it to access unapproved classes and methods.

Recommendations For versions prior to 9.4.0.1, update to version 9.4.0.1 or later. For versions prior to 9.3.0.3, update to version 9.3.0.3 or later. For version 8.3.x, consider upgrading to a newer version that includes the necessary security fixes, as version 8.3.x is affected.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-4815

Affected Products

Pentaho Business Analytics Server

References · 3

• https://support.pentaho.com/hc/en-us/articles/14455879270285-IMPORTANT-Resolved-Pentaho-BA-Server-Deserialization-of-Untrusted-Data-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2022-4815- · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4815 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4815 · Vendor Advisory