Pentaho Business Analytics Server vulnerabilities
12 known vulnerabilities in Pentaho Business Analytics Server from Hitachi Vantara. 12 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.9 Critical severity
Pentaho Data Integration & Analytics: Deserialization of Untrusted Data
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data
- 8.8 High severity
Pentaho Data Integration & Analytics: Improper Control of Resource Identifiers
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99) Hitachi Vantara Pentaho Data Integ
- 8.8 High severity
Pentaho Data Integration & Analytics: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. (CWE-863) Hitachi Vantara Pentaho Business
- 8.6 High severity
Pentaho Data Integration & Analytics: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. (CWE-918) Hitachi Vantara Pentaho Business Analy
- 8.2 High severity
Pentaho Business Analytics Server: Improper Restriction of Recursive Entity References in DTDs
Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of the Pentaho User Console against XML External Entity Reference.
- 8.8 High severity
Pentaho Business Analytics Server: Deserialization of Untrusted Data
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods.
- 8.1 High severity
Pentaho Business Analytics Server: Incorrect Authorization
Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.4 and 8.3.0.27 does not correctly perform an authorization check in the dashboard editor plugin API.
- 8.8 High severity
Pentaho Business Analytics Server: Incorrect Authorization
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the data source management service.
- 9.8 Critical severity
Hitachi Vantara Pentaho BA Server Authorization Bypass Exploited
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
- 8.8 High severity
Pentaho Business Analytics Server: Improper Control of Generation of Code
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager.
- 8.8 High severity
Pentaho Business Analytics Server: Incorrect Permission Assignment for Critical Resource
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configured with stored procedures enabled.
- 7.2 High severity
Hitachi Vantara Pentaho BA Server Special Element Injection Exploited
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.