Hitachi Vantara Pentaho Business Analytics Server
By the Year
In 2024 there have been 0 vulnerabilities in Hitachi Vantara Pentaho Business Analytics Server . Last year Vantara Pentaho Business Analytics Server had 14 security vulnerabilities published. Right now, Vantara Pentaho Business Analytics Server is on track to have less security vulnerabilities in 2024 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 14 | 6.93 |
| 2022 | 0 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Vantara Pentaho Business Analytics Server vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Hitachi Vantara Pentaho Business Analytics Server Security Vulnerabilities
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3
CVE-2022-4815
8.8 - High
- May 24, 2023
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods.
Marshaling, Unmarshaling
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3
CVE-2023-1158
4.3 - Medium
- May 24, 2023
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list.
AuthZ
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x
CVE-2022-4771
6.1 - Medium
- April 03, 2023
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow a malicious URL to inject content into the Pentaho User Console through session variables.
XSS
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2
CVE-2022-4770
4.3 - Medium
- April 03, 2023
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt).
Generation of Error Message Containing Sensitive Information
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2
CVE-2022-4769
4.3 - Medium
- April 03, 2023
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploaded with an invalid character in its name.
Generation of Error Message Containing Sensitive Information
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2
CVE-2022-43941
6.5 - Medium
- April 03, 2023
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference.
XXE
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2
CVE-2022-43940
8.8 - High
- April 03, 2023
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the data source management service.
AuthZ
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs
CVE-2022-43939
9.8 - Critical
- April 03, 2023
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot
CVE-2022-43938
8.8 - High
- April 03, 2023
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager.
Code Injection
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1
CVE-2022-43772
6.5 - Medium
- April 03, 2023
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs.
Insertion of Sensitive Information into Log File
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources
CVE-2022-43771
6.5 - Medium
- April 03, 2023
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds.
Directory traversal
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot
CVE-2022-3960
6.3 - Medium
- April 03, 2023
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin.
Code Injection
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2
CVE-2022-43773
8.8 - High
- April 03, 2023
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configured with stored procedures enabled.
Incorrect Permission Assignment for Critical Resource
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates
CVE-2022-43769
7.2 - High
- April 03, 2023
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.
Code Injection
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Hitachi Vantara Pentaho Business Analytics Server or by Hitachi? Click the Watch button to subscribe.
