Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data

CVE-2022-4815

Summary

Hitachi Vantara Pentaho Business Analytics Server versions earlier than 9.4.0.1 and 9.3.0.3, as well as all versions in the 8.3.x series, are susceptible to a vulnerability that allows deserialization of untrusted JSON data. This flaw arises from the absence of constraints on the parser, permitting it to process potentially malicious data. The lack of validation and control over the classes and methods involved can lead to security risks, enabling attackers to exploit this weakness to execute unauthorized actions on affected systems.

References