CVE-2022-3960mediumCWE-96

CVE-2022-3960: falha de média gravidade em Hitachi Vantara Pentaho Business Analytics…

Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Pentaho Business Analytics Server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.5%
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin. 
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
Hitachi Vantara · Pentaho Business Analytics Server
CVEs relacionadas — Hitachi Vantara Pentaho Business Analytics…

No mesmo produto, das mais perigosas para as menos.

CVE-2022-43769HIGHHitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)EPSS 97.7%KEVCVE-2022-43939HIGHHitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization DecisionsEPSS 92.3%KEVCVE-2022-43938HIGHHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') EPSS 26.4%CVE-2022-43771MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') EPSS 23.9%CVE-2022-43773HIGHHitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource EPSS 22.2%CVE-2024-5706HIGHHitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')EPSS 0.7%