PT-2023-2237 · Hitachi Vantara · Hitachi Vantara Pentaho Business Analytics Server

Published 2023-04-03 · Updated 2023-04-10 · CVE-2022-3960

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.4.0.1 and 9.3.0.2, including 8.3.x

Description The issue is related to errors in input data processing during code syntax analysis. Exploitation of this issue may allow a remote attacker to execute arbitrary code. A system administrator cannot disable the scripting capabilities of the Community Dashboard Editor (CDE) plugin, which is a part of the affected server.

Recommendations For versions prior to 9.4.0.1, update to version 9.4.0.1 or later. For versions prior to 9.3.0.2, update to version 9.3.0.2 or later. As a temporary workaround, consider disabling the Community Dashboard Editor (CDE) plugin until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-96

CWE-94

Related Identifiers

BDU:2023-01992

CVE-2022-3960

Affected Products

Hitachi Vantara Pentaho Business Analytics Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-3960 · Security Note
• https://bdu.fstec.ru/vul/2023-01992 · Security Note
• https://support.pentaho.com/hc/en-us/articles/14456813547917--Resolved-Pentaho-BA-Server-Improper-Neutralization-of-Directives-in-Statically-Saved-Code-Static-Code-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-CVE-2022-3960- · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3960 · Vendor Advisory
• https://t.me/cibsecurity/61351 · Telegram Post