vantara_pentaho_business_analytics_server 漏洞

高危CVE-2022-437692023/04/04

Hitachi Pentaho Business Analytics Server - Remote Code Execution

Hitachi Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x, is susceptible to remote code execution via server-side template injection. Certain web services can set property values which contain Spring templates that are interpreted downstream, thereby potentially enabling an attacker to execute malware, obtain sensitive information, modify data, and/or perform unauthorized operations without entering necessary credentials.

vantara_pentaho_business_analytics_serverPoC 已收录

CVSS7.2EPSS 93.8%

严重CVE-2022-439392023/04/03

Hitachi Pentaho Business Analytics Server - Bypass Authorization

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.

vantara_pentaho_business_analytics_serverPoC 已收录

CVSS8.6EPSS 87.5%

vantara_pentaho_business_analytics_server

关联漏洞

Hitachi Pentaho Business Analytics Server - Remote Code Execution

Hitachi Pentaho Business Analytics Server - Bypass Authorization