Pentaho Business Analytics
Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho
Analyzer plugin exposes a service endpoint for templates which allows a
user-supplied path to access resources that are out of bounds.
The software uses external input to construct a pathname that is intended to identify a file or
directory that is located underneath a restricted parent directory, but the software does not
properly neutralize special elements within the pathname that can cause the pathname to
resolve to a location that is outside of the restricted directory. By using special elements such as
".." and "/" separators, attackers can escape outside of the restricted
location to access files or directories that are elsewhere on the
system.
References
| Link | Resource |
|---|---|
| https://support.pentaho.com/hc/en-us/articles/6744743458701 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
07 Nov 2023, 03:39
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user-supplied path to access resources that are out of bounds. The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. |
04 Nov 2022, 02:48
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 | |
| CPE | cpe:2.3:a:hitachi:vantara_pentaho:*:*:*:*:*:*:*:* | |
| References | (MISC) https://support.pentaho.com/hc/en-us/articles/6744743458701 - Vendor Advisory | |
| First Time |
Hitachi vantara Pentaho
Hitachi |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
02 Nov 2022, 16:55
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-11-02 16:15
Updated : 2023-12-10 14:35
NVD link : CVE-2021-45448
Mitre link : CVE-2021-45448
CVE.ORG link : CVE-2021-45448
JSON object : View
Products Affected
hitachi
- vantara_pentaho
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')