Hitachi Vantara Pentaho Business Analytics Server vulnerabilities
14 vulnerabilities
Known vulnerabilities in Hitachi Vantara Pentaho Business Analytics Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2022-4769hitachi vantarapentaho business analytics server+1
EPSS score0.43%
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploaded with an invalid character in its name.CVE-2022-4770hitachi vantarapentaho business analytics server+1EPSS score0.43%
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt).CVE-2022-4771hitachi vantarapentaho business analytics server+1EPSS score0.35%
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow a malicious URL to inject content into the Pentaho User Console through session variables.CVE-2022-4815hitachi vantarapentaho business analytics server+2EPSS score0.63%
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods.CVE-2022-43940hitachi vantarapentaho business analytics server+1EPSS score0.56%
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the data source management service.CVE-2022-43773hitachi vantarapentaho business analytics server+1EPSS score22.18%
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configured with stored procedures enabled.CVE-2022-43771hitachi vantarapentaho business analytics server+1EPSS score23.89%
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds.CVE-2022-43769hitachi vantarapentaho business analytics server+1KEVEPSS score97.67%
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.CVE-2022-43941hitachi vantarapentaho business analytics server+1EPSS score0.53%
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference.CVE-2022-43938hitachi vantarapentaho business analytics server+1EPSS score26.44%
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager.CVE-2022-43939hitachi vantarapentaho business analytics server+1KEVEPSS score92.27%
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.CVE-2022-43772hitachi vantarapentaho business analytics server+1EPSS score0.39%
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs.CVE-2022-3960hitachi vantarapentaho business analytics server+1EPSS score0.45%
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin.CVE-2023-1158hitachi vantarapentaho business analytics server+2EPSS score0.38%
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list.