Vantara Pentaho
Approved changes feed: RSS · Atom
cpe:2.3:a:hitachi:vantara_pentaho:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Hitachi (437a37e3-5ce7-5362-9e23-5ea2c73e6d98) |
|---|---|
| Product | Vantara Pentaho (c9e07302-29aa-5a57-b656-95dc607f3c47) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-1158 |
vulnerable | 2026-06-08 05:52:33.997887 |
Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization
MEDIUM (4.3)
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list.
Published: 2023-05-24T21:26:53.129Z
Updated: 2025-01-16T15:30:17.683Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4815 |
vulnerable | 2026-06-08 05:52:00.412979 |
Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data
HIGH (8)
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods.
Published: 2023-05-24T21:30:37.243Z
Updated: 2025-01-16T15:29:21.796Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-45448 |
vulnerable | 2026-06-08 05:36:48.153541 |
Pentaho Business Analytics Server - Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user supplied path to access resources that are out of bounds.
HIGH (7.1)
Pentaho Business Analytics
Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho
Analyzer plugin exposes a service endpoint for templates which allows a
user-supplied path to access resources that are out of bounds.
The software uses external input to construct a pathname that is intended to identify a file or
directory that is located underneath a restricted parent directory, but the software does not
properly neutralize special elements within the pathname that can cause the pathname to
resolve to a location that is outside of the restricted directory. By using special elements such as
".." and "/" separators, attackers can escape outside of the restricted
location to access files or directories that are elsewhere on the
system.
Published: 2022-11-02T15:12:25.164Z
Updated: 2025-05-02T15:48:03.329Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-45447 |
vulnerable | 2026-06-08 05:36:48.152976 |
Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear text
HIGH (7.7)
Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and
8.3.0.25 with the Data Lineage feature enabled transmits database passwords in clear text.
The transmission of sensitive data in clear text allows unauthorized actors with access to the
network to sniff and obtain sensitive information that can be later used to gain unauthorized
access.
Published: 2022-11-02T14:56:01.585Z
Updated: 2025-05-02T20:38:51.406Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-45446 |
vulnerable | 2026-06-08 05:36:48.152462 |
Pentaho Business Analytics Server - Exposure of Information Through Directory Listing
MEDIUM (5)
A vulnerability in
Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and
8.3.0.25 does not cascade the hidden property to the children of the Home folder. This directory listing provides an attacker with the complete index of all the resources located
inside the directory.
Published: 2022-11-02T14:26:02.105Z
Updated: 2025-05-02T15:52:28.178Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-34685 |
vulnerable | 2026-06-08 05:32:14.399404 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-34684 |
vulnerable | 2026-06-08 05:32:14.398839 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-31602 |
vulnerable | 2026-06-08 05:31:53.736485 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-31601 |
vulnerable | 2026-06-08 05:31:53.736107 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-31600 |
vulnerable | 2026-06-08 05:31:53.735722 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-31599 |
vulnerable | 2026-06-08 05:31:53.734502 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24670 |
vulnerable | 2026-06-08 05:22:35.291383 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24669 |
vulnerable | 2026-06-08 05:22:35.291023 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24666 |
vulnerable | 2026-06-08 05:22:35.287506 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24665 |
vulnerable | 2026-06-08 05:22:35.287136 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24664 |
vulnerable | 2026-06-08 05:22:35.286557 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.