PT-2023-2234 · Hitachi Vantara · Pentaho Business Analytics Server

Published 2023-04-03 · Updated 2023-04-10 · CVE-2022-4769

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.4.0.0 Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.3.0.2 Hitachi Vantara Pentaho Business Analytics Server version 8.3.x

Description The issue is related to the display of the target path on the host when a file is uploaded with an invalid character in its name. This can potentially allow a remote attacker to gain unauthorized access to protected information due to weaknesses in the error reporting mechanism.

Recommendations For versions prior to 9.4.0.0, update to version 9.4.0.0 or later. For versions prior to 9.3.0.2, update to version 9.3.0.2 or later. For version 8.3.x, consider upgrading to a newer version to mitigate the risk, as this version is affected. As a temporary workaround, consider restricting file uploads with invalid characters in their names until a patch is available.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BDU:2023-01989

CVE-2022-4769

Affected Products

Pentaho Business Analytics Server

References · 7

• https://osv.dev/vulnerability/CVE-2022-4769 · Vendor Advisory
• https://support.pentaho.com/hc/en-us/articles/14452244712589--Resolved-Pentaho-BA-Server-Generation-of-Error-Message-Containing-Sensitive-Information-Versions-before-9-4-0-0-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-4769- · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01989 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-4769 · Security Note
• https://t.me/cibsecurity/61348 · Telegram Post
• https://t.me/cvenotify/47446 · Telegram Post
• https://t.me/cvenotify/47901 · Telegram Post