Pentaho Business Analytics Server - Exposure of Information Through Directory Listing
CVE-2021-45446

5MEDIUM

Key Information:

Vendor
Hitachi
Status
Pentaho Business Analytics Server
Vendor
CVE Published:
2 November 2022

Summary

A vulnerability in

Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 does not cascade the hidden property to the children of the Home folder.  This directory listing provides an attacker with the complete index of all the resources located inside the directory.

Affected Version(s)

Pentaho Business Analytics Server 1.0 < 8.3.0.25

Pentaho Business Analytics Server 9.0 < 9.2.0.2

References

https://support.pentaho.com/hc/en-us/articles/6744813983501

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.