CVE-2022-43939
Yüksek CISA KEV: Aktif İstismarTeknik Veri (Otomatik)
- CVSS Skoru
- 8.6
- EPSS
- 92.3%
- CWE
- CWE-647
- KEV Durumu
- Evet
Yayım tarihi: 3 Nisan 2023 · CISA KEV son iyileştirme tarihi: 24 Mart 2025
Etkilenen: hitachi vantara_pentaho_business_analytics_server
Hitachi Vantara Pentaho Business Analytics Server'in 9.4.0.1 ve 9.3.0.2 sürümlerinden önceki sürümleri, 8.3.x sürümleri dahil, kanonik olmayan URL'leri kullanarak güvenlik kısıtlamaları içerir ve bu kısıtlamalar atlanabilir.
Orijinal açıklama (İngilizce)
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
Referanslar
- http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html
- https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-BA-Server-Use-of-Non-Canonical-URL-Paths-for-Authorization-Decisions-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43939-
- http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html
- https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-BA-Server-Use-of-Non-Canonical-URL-Paths-for-Authorization-Decisions-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43939-
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-43939
Bu CVE için henüz editoryal inceleme yapılmadı. Sadece otomatik teknik veri gösteriliyor.