SQL Injection Vulnerability in Hitachi Vantara Pentaho Business Analytics
CVE-2021-34684

9.8CRITICAL

Key Information:

Vendor
Hitachi
Status
Vantara Pentaho
Vendor
CVE Published:
8 November 2021

Summary

The vulnerability in Hitachi Vantara Pentaho Business Analytics through version 9.1 allows an unauthenticated user to execute arbitrary SQL queries. This vulnerability can be exploited via specific URIs, enabling attackers to gain unauthorized access to sensitive data stored within related databases. If exploited, it could lead to severe data breaches, making it imperative for users to apply necessary security updates to mitigate risks.

References

https://www.hitachi.com/hirt/security/index.html
x_refsource_MISC
http://packetstormsecurity.com/files/164791/Pentaho-Busin...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.