PT-2023-2240 · Hitachi Vantara · Pentaho Business Analytics Server

Published 2023-04-03 · Updated 2023-04-10 · CVE-2022-43941

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.4.0.1 and 9.3.0.2, including 8.3.x

Description The issue is related to incorrect restriction of XML links to external objects, which can allow a remote attacker to conduct XXE attacks by exploiting the Post Analysis service endpoint of the data access plugin.

Recommendations For versions prior to 9.4.0.1, update to version 9.4.0.1 or later. For versions prior to 9.3.0.2, update to version 9.3.0.2 or later. As a temporary workaround, consider restricting access to the Post Analysis service endpoint of the data access plugin until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2023-01995

CVE-2022-43941

Affected Products

Pentaho Business Analytics Server

References · 5

• https://bdu.fstec.ru/vul/2023-01995 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43941 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43941 · Security Note
• https://support.pentaho.com/hc/en-us/articles/14456719346957--Resolved-Pentaho-BA-Server-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-CVE-2022-43941- · Vendor Advisory
• https://t.me/cibsecurity/61357 · Telegram Post