PT-2023-2907 · Hitachi Vantara · Hitachi Vantara Pentaho Business Analytics Server

Published 2023-05-24 · Updated 2023-06-01 · CVE-2023-1158

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x

Description The issue is related to improper authorization in the Hitachi Vantara Pentaho Business Analytics Server. Exploitation of this issue may allow a remote attacker to disclose protected information.

Recommendations For versions before 9.4.0.1, update to version 9.4.0.1 or later. For versions before 9.3.0.3, update to version 9.3.0.3 or later. For version 8.3.x, consider upgrading to a newer version that includes the necessary security fixes. At the moment, there is no information about additional mitigation measures for version 8.3.x.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2023-02862

CVE-2023-1158

Affected Products

Hitachi Vantara Pentaho Business Analytics Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-1158 · Security Note
• https://support.pentaho.com/hc/en-us/articles/14456024873741-IMPORTANT-Resolved-Pentaho-BA-Server-Incorrect-Authorization-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2023-1158- · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02862 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1158 · Vendor Advisory
• https://vuldb.com/?id.229914 · Note