Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference

CVE-2022-43941

7.1HIGH

Key Information

Vendor: Hitachi
Status: Pentaho Business Analytics Server
Vendor: CVE Published:; 3 April 2023

Summary

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference.

Affected Version(s)

Pentaho Business Analytics Server < 9.3.0.2

Pentaho Business Analytics Server < 9.4.0.1

CVSS V3.1

Score:

7.1

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Risk change from: 6.5 to: 7.1 - (HIGH)
Feb 22, 2024
Vulnerability published.
Apr 3, 2023
Vulnerability Reserved.
Oct 26, 2022

Collectors

NVD DatabaseMitre Database

Credit

Harry Withington, Aura Information Security