Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data

CVE-2022-4815
8HIGH

Key Information

Vendor
Hitachi
Status
Pentaho Business Analytics Server
Vendor
CVE Published:
24 May 2023

Summary

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods. 

Affected Version(s)

Pentaho Business Analytics Server < 9.3.0.3

Pentaho Business Analytics Server < 9.4.0.1

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Risk change from: 8.8 to: 8 - (HIGH)

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database

Credit

Clarence Liau
Hitachi Group Member
.