CVE-2022-43769
Yüksek CISA KEV: Aktif İstismarTeknik Veri (Otomatik)
- CVSS Skoru
- 8.8
- EPSS
- 97.7%
- CWE
- CWE-74
- KEV Durumu
- Evet
Yayım tarihi: 3 Nisan 2023 · CISA KEV son iyileştirme tarihi: 24 Mart 2025
Etkilenen: hitachi vantara_pentaho_business_analytics_server
Hitachi Vantara Pentaho Business Analytics Server, 9.4.0.1 ve 9.3.0.2 sürümlerinden önceki sürümler, 8.3.x sürümlerini de içerecek şekilde, belirli web hizmetlerinin Spring şablonları içerdiği mülk değerlerini ayarlamasına izin verir.
Orijinal açıklama (İngilizce)
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.
Referanslar
- http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html
- https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769-
- http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html
- https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769-
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-43769
Bu CVE için henüz editoryal inceleme yapılmadı. Sadece otomatik teknik veri gösteriliyor.