PT-2023-2232 · Hitachi Vantara · Pentaho Business Analytics Server+1

Published 2023-04-03 · Updated 2023-04-10 · CVE-2022-43771

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.4.0.0 Hitachi Vantara Pentaho Business Analytics Server version 9.3.0.1 and earlier Hitachi Vantara Pentaho Business Analytics Server versions 8.3.x

Description The issue is related to incorrect restriction of a directory path name with limited access. This can allow a remote attacker to gain unauthorized access to protected information. The Pentaho Data Access plugin exposes a service endpoint for CSV import, which allows a user-supplied path to access resources that are out of bounds.

Recommendations For versions prior to 9.4.0.0, update to version 9.4.0.0 or later. For version 9.3.0.1 and earlier, update to version 9.3.0.1 or later, or apply the necessary patch. For versions 8.3.x, consider disabling the Pentaho Data Access plugin until a patch is available, or restrict access to the CSV import service endpoint to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-01987

CVE-2022-43771

Affected Products

Pentaho Business Analytics Server

Pentaho Data Access

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-43771 · Security Note
• https://support.pentaho.com/hc/en-us/articles/14455007818509--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Limitation-of-a-Pathname-to-a-Restricted-Directory-Path-Traversal-Versions-before-9-4-0-0-and-9-3-0-1-including-8-3-x-Impacted-CVE-2022-43771- · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01987 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43771 · Vendor Advisory
• https://t.me/cibsecurity/61343 · Telegram Post