CVE-2021-31599

Опубликовано: 08 нояб. 2021

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. A reports (.prpt) file allows the inclusion of BeanShell scripts to ease the production of complex reports. An authenticated user can run arbitrary code.

Ссылки

http://packetstormsecurity.com/files/164772/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://www.hitachi.com/hirt/security/index.html
Vendor Advisory
http://packetstormsecurity.com/files/164772/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://www.hitachi.com/hirt/security/index.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:hitachi:vantara_pentaho:*:*:*:*:*:*:*:*

Версия до 9.1.0.0 (включая)

cpe:2.3:a:hitachi:vantara_pentaho_business_intelligence_server:*:*:*:*:*:*:*:*

Версия до 7.1 (включая)

EPSS

Процентиль: 75%

0.00886

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-6wxg-5c2w-6qpw

github

больше 3 лет назад