title: Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
description:
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.
problem types: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
affected:
{
defaultStatus: unaffected
product: Pentaho Business Analytics Server
vendor: Hitachi Vantara
versions:
lessThan: 9.3.0.2, status: affected, version: 1.0, versionType: maven
lessThan: 9.4.0.1, status: affected, version: 9.4.0.0, versionType: maven
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL