Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization

CVE-2022-43770

5.4MEDIUM

Key Information

Vendor: Hitachi
Status: Pentaho Business Analytics Server
Vendor: CVE Published:; 11 April 2023

Summary

Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.4 and 8.3.0.27 does not correctly perform an authorization check in the dashboard editor plugin API.

Affected Version(s)

Pentaho Business Analytics Server < 8.3.0.27

Pentaho Business Analytics Server < 9.2.0.4

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Risk change from: 8.1 to: 5.4 - (MEDIUM)
Feb 22, 2024
Vulnerability published.
Apr 11, 2023
Vulnerability Reserved.
Oct 26, 2022

Collectors

NVD DatabaseMitre Database

Credit

Hitachi Group Member