PT-2023-2235 · Hitachi Vantara · Hitachi Vantara Pentaho Business Analytics Server

Published 2023-04-03 · Updated 2023-04-10 · CVE-2022-4770

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.4.0.0 and 9.3.0.2, including 8.3.x

Description The issue is related to the error handling mechanism in Hitachi Vantara Pentaho Business Analytics Server, which displays the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt). This can allow a remote attacker to gain unauthorized access to protected information.

Recommendations For versions prior to 9.4.0.0, update to version 9.4.0.0 or later. For versions prior to 9.3.0.2, update to version 9.3.0.2 or later. As a temporary workaround, consider restricting access to Pentaho Reports (*.prpt) to minimize the risk of exploitation.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BDU:2023-01990

CVE-2022-4770

Affected Products

Hitachi Vantara Pentaho Business Analytics Server

References · 6

• https://bdu.fstec.ru/vul/2023-01990 · Security Note
• https://support.pentaho.com/hc/en-us/articles/14455209015949--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Generation-of-Error-Message-Containing-Sensitive-Information-Versions-before-9-4-0-0-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-4770- · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4770 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4770 · Security Note
• https://t.me/cibsecurity/61350 · Telegram Post
• https://t.me/cvenotify/47445 · Telegram Post