Vulnerability · Published Apr 3, 2023 · Assigned by HITVAN
CVE-2022-43771Hitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Medium 6.5
In plain English
A medium-severity path traversal in Pentaho Business Analytics Server from Hitachi Vantara. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 23.9% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)23.9%top 2.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hitachi Vantara | Pentaho Business Analytics Server | 1.0 – before 9.3.0.1 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N