CVE-2023-1158

Published: May 24, 2023Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list.

Affected (3)

Products: Hitachi: Vantara Pentaho, Vantara Pentaho Business Analytics Server

Hitachi

2 products

Vantara Pentaho

Vantara Pentaho Business Analytics Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Hitachi Vantara Pentaho	From 8.3.0.0 to 8.3.0.25
Hitachi Vantara Pentaho Business Analytics Server	From 9.3.0.0 to 9.3.0.3
Hitachi Vantara Pentaho Business Analytics Server	Version 9.4.0.0

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://support.pentaho.com/hc/en-us/articles/14456024873741-IMPORTANT-Resolved-Pentaho-BA-Server-Incorrect-Authorization-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2023-1158-

Source: security.vulnerabilities@hitachivantara.com

Vendor Advisory

https://support.pentaho.com/hc/en-us/articles/14456024873741-IMPORTANT-Resolved-Pentaho-BA-Server-Incorrect-Authorization-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2023-1158-

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.