CVE-2022-43771

Katalog CVE

CVSS 6.5 · Medium EPSS 23,9%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada hitachi vantara pentaho business analytics server. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds.  

Rincian

Terbit di NVD

3 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

23,9% peluang dieksploitasi; lebih tinggi dari 97,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.pentaho.com/hc/en-us/articles/14455007818509--Resolved-Hitachi-Vantara-Pentaho-Business-Analyt... advisory vendor