CVE-2022-43771 - Hitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Back Back to CVE browser

MEDIUM

Hitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Published Apr 3, 2023

6.5

MEDIUM

CVSS 3.1

EPSS 23.89%

Description

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds.

Affected products

Vendor Hitachi Vantara Product Pentaho Business Analytics Server Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <9.3.0.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Hitachi Vantara

Pentaho Business Analytics Server

unaffected

Version	Status	Constraints
1.0	affected	<9.3.0.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46741		Advisory
https://support.pentaho.com/hc/en-us/articles/14455007818509--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Limitation-of-a-Pathname-to-a-Restricted-Directory-Path-Traversal-Versions-before-9-4-0-0-and-9-3-0-1-including-8-3-x-Impacted-CVE-2022-43771-		Vendor Advisory