Vantara Pentaho Business Analytics Server

vantara_pentaho_business_analytics_server

Vendor: Hitachi • 14 CVEs

CVEs (14)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-1158 1Hitachi 2Vantara Pentaho Vantara Pentaho Business Analytics Server Jun 17, 2026 May 24, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list.
CVE-2022-4815 1Hitachi 2Vantara Pentaho Vantara Pentaho Business Analytics Server Jun 17, 2026 May 24, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods.
CVE-2022-4771 1Hitachi 1Vantara Pentaho Business Analytics Server Jun 17, 2026 Apr 3, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow a malicious URL to inject content into the Pentaho User Console through session variables.
CVE-2022-4770 1Hitachi 1Vantara Pentaho Business Analytics Server Jun 17, 2026 Apr 3, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Rep...Show more Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt). Show less
CVE-2022-4769 1Hitachi 1Vantara Pentaho Business Analytics Server Jun 17, 2026 Apr 3, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploaded with an invalid character in its name.
CVE-2022-43941 1Hitachi 1Vantara Pentaho Business Analytics Server Jun 17, 2026 Apr 3, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML Extern...Show more Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference. Show less
CVE-2022-43940 1Hitachi 1Vantara Pentaho Business Analytics Server Jun 17, 2026 Apr 3, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the data source management service.
CVE-2022-43939 1Hitachi 1Vantara Pentaho Business Analytics Server Jun 17, 2026 Apr 3, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
CVE-2022-43938 1Hitachi 1Vantara Pentaho Business Analytics Server Jun 17, 2026 Apr 3, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (.prpt) through the JVM...Show more Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (.prpt) through the JVM script manager. Show less
CVE-2022-43772 1Hitachi 1Vantara Pentaho Business Analytics Server Jun 17, 2026 Apr 3, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs.
CVE-2022-43771 1Hitachi 1Vantara Pentaho Business Analytics Server Jun 17, 2026 Apr 3, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to...Show more Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds. Show less
CVE-2022-3960 1Hitachi 1Vantara Pentaho Business Analytics Server Jun 17, 2026 Apr 3, 2023 N/A· v4 6.3 MEDIUM· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plug...Show more Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin. Show less
CVE-2022-43773 1Hitachi 1Vantara Pentaho Business Analytics Server Jun 17, 2026 Apr 3, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configured with stored procedures enabled.
CVE-2022-43769 1Hitachi 1Vantara Pentaho Business Analytics Server Jun 17, 2026 Apr 3, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.