PT-2023-2005 · Hitachi · Hitachi Ops Center Analyzer+1

Published 2023-02-27 · Updated 2023-03-08 · CVE-2022-4895

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions Hitachi Infrastructure Analytics Advisor versions 2.0.0-00 through 4.4.0-00 Hitachi Ops Center Analyzer versions 10.0.0-00 through 10.9.0-00

Description The issue is related to improper certificate validation, which allows a Man in the Middle Attack. This can be exploited by a remote attacker. The vulnerability affects the Analytics probe component of Hitachi Infrastructure Analytics Advisor and the Analyzer probe component of Hitachi Ops Center Analyzer.

Recommendations For Hitachi Infrastructure Analytics Advisor versions 2.0.0-00 through 4.4.0-00, update to a version after 4.4.0-00. For Hitachi Ops Center Analyzer versions 10.0.0-00 through 10.9.0-00, update to version 10.9.1-00 or later. As a temporary workaround, consider disabling the vulnerable components until a patch is available. Restrict access to the affected components to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2023-01629

CVE-2022-4895

Affected Products

Hitachi Infrastructure Analytics Advisor

Hitachi Ops Center Analyzer

References · 7

• https://osv.dev/vulnerability/CVE-2022-4895 · Vendor Advisory
• https://hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-105/index.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4895 · Security Note
• https://bdu.fstec.ru/vul/2023-01629 · Security Note
• https://t.me/cvenotify/45134 · Telegram Post
• https://t.me/cvenotify/45809 · Telegram Post
• https://t.me/cibsecurity/59084 · Telegram Post