CVE-2021-45448 (GCVE-0-2021-45448)
Vulnerability from cvelistv5
Published
2022-11-02 15:12
Modified
2024-08-04 04:39
Severity ?
7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Summary
Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user-supplied path to access resources that are out of bounds.  The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.  By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system.
References
security.vulnerabilities@hitachivantara.comhttps://support.pentaho.com/hc/en-us/articles/6744743458701Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://support.pentaho.com/hc/en-us/articles/6744743458701Vendor Advisory
Impacted products
Vendor Product Version
Hitachi Vantara Pentaho Business Analytics Server Version: 9.2
Version: 1.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T04:39:21.052Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.pentaho.com/hc/en-us/articles/6744743458701",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               modules: [
                  "Pentaho Analyzer plugin",
               ],
               product: "Pentaho Business Analytics Server",
               vendor: "Hitachi Vantara",
               versions: [
                  {
                     lessThan: "9.2.0.2",
                     status: "affected",
                     version: "9.2",
                     versionType: "ALL",
                  },
                  {
                     lessThan: "8.3.0.25",
                     status: "affected",
                     version: "1.0",
                     versionType: "All",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n<p>Pentaho Business Analytics\n Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho \nAnalyzer plugin exposes a service endpoint for templates which allows a \nuser-supplied path to access resources that are out of bounds.&nbsp;\n\nThe software uses external input to construct a pathname that is intended to identify a file or \ndirectory that is located underneath a restricted parent directory, but the software does not \nproperly neutralize special elements within the pathname that can cause the pathname to \nresolve to a location that is outside of the restricted directory. <span style=\"background-color: var(--wht);\">&nbsp;By using special elements such as \n\"..\" and \"/\" separators, attackers can escape outside of the restricted \nlocation to access files or directories that are elsewhere on the \nsystem.</span></p>\n\n",
                  },
               ],
               value: "Pentaho Business Analytics\n Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho \nAnalyzer plugin exposes a service endpoint for templates which allows a \nuser-supplied path to access resources that are out of bounds. \n\nThe software uses external input to construct a pathname that is intended to identify a file or \ndirectory that is located underneath a restricted parent directory, but the software does not \nproperly neutralize special elements within the pathname that can cause the pathname to \nresolve to a location that is outside of the restricted directory.  By using special elements such as \n\"..\" and \"/\" separators, attackers can escape outside of the restricted \nlocation to access files or directories that are elsewhere on the \nsystem.\n\n\n\n",
            },
         ],
         impacts: [
            {
               descriptions: [
                  {
                     lang: "en",
                     value: "Many file operations are intended to take place within a restricted directory. By using special  elements such as \"..\" and \"/\" separators, attackers can escape outside of the restricted  location to access files or directories that are elsewhere on the system",
                  },
               ],
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-22",
                     description: "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-11-02T15:12:25.164Z",
            orgId: "dce6e192-ff49-4263-9134-f0beccb9bc13",
            shortName: "HITVAN",
         },
         references: [
            {
               url: "https://support.pentaho.com/hc/en-us/articles/6744743458701",
            },
         ],
         solutions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\n\nThe defect may be mitigated either by uninstalling the Pentaho Analyzer plugin or upgrading&nbsp;to the latest Hitachi Vantara Pentaho version \n9.3 release. For versions 9.2 and 8.3 we recommend updating to Service \nPacks 9.2.0.2/8.3.0.25 or above where this vulnerability is addressed. \n\n<br>",
                  },
               ],
               value: "\n\nThe defect may be mitigated either by uninstalling the Pentaho Analyzer plugin or upgrading to the latest Hitachi Vantara Pentaho version \n9.3 release. For versions 9.2 and 8.3 we recommend updating to Service \nPacks 9.2.0.2/8.3.0.25 or above where this vulnerability is addressed. \n\n\n",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         title: "Pentaho Business Analytics Server - Pentaho Analyzer plugin exposes a service endpoint for templates which  allows a user supplied path to access resources that are out of bounds.",
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "dce6e192-ff49-4263-9134-f0beccb9bc13",
      assignerShortName: "HITVAN",
      cveId: "CVE-2021-45448",
      datePublished: "2022-11-02T15:12:25.164Z",
      dateReserved: "2021-12-21T05:57:40.703Z",
      dateUpdated: "2024-08-04T04:39:21.052Z",
      requesterUserId: "520cc88b-a1c8-44f6-9154-21a4d74c769f",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      fkie_nvd: {
         configurations: "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:hitachi:vantara_pentaho:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.3.0.0\", \"versionEndExcluding\": \"8.3.0.25\", \"matchCriteriaId\": \"AB67F45F-D25C-4B85-8819-433D89F3EF1F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:hitachi:vantara_pentaho:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"9.2.0.0\", \"versionEndExcluding\": \"9.2.0.2\", \"matchCriteriaId\": \"111F5389-BE1D-480F-8229-3EEDF8F6D82A\"}]}]}]",
         descriptions: "[{\"lang\": \"en\", \"value\": \"Pentaho Business Analytics\\n Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho \\nAnalyzer plugin exposes a service endpoint for templates which allows a \\nuser-supplied path to access resources that are out of bounds.\\u00a0\\n\\nThe software uses external input to construct a pathname that is intended to identify a file or \\ndirectory that is located underneath a restricted parent directory, but the software does not \\nproperly neutralize special elements within the pathname that can cause the pathname to \\nresolve to a location that is outside of the restricted directory. \\u00a0By using special elements such as \\n\\\"..\\\" and \\\"/\\\" separators, attackers can escape outside of the restricted \\nlocation to access files or directories that are elsewhere on the \\nsystem.\\n\\n\\n\\n\"}, {\"lang\": \"es\", \"value\": \"Las versiones de Pentaho Business Analytics Server anteriores a 9.2.0.2 y 8.3.0.25 que utilizan el complemento Pentaho Analyzer exponen un endpoint de servicio para plantillas que permite una ruta proporcionada por el usuario para acceder a recursos que est\\u00e1n fuera de los l\\u00edmites. El software utiliza entradas externas para construir un nombre de ruta destinado a identificar un archivo o directorio que se encuentra debajo de un directorio principal restringido, pero el software no neutraliza adecuadamente los elementos especiales dentro del nombre de ruta que pueden hacer que el nombre de ruta se resuelva en una ubicaci\\u00f3n que est\\u00e1 fuera del directorio restringido. Al utilizar elementos especiales como separadores \\\"..\\\" y \\\"/\\\", los atacantes pueden escapar de la ubicaci\\u00f3n restringida para acceder a archivos o directorios que se encuentran en otras partes del sistema.\"}]",
         id: "CVE-2021-45448",
         lastModified: "2024-11-21T06:32:13.740",
         metrics: "{\"cvssMetricV31\": [{\"source\": \"security.vulnerabilities@hitachivantara.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 4.2}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}]}",
         published: "2022-11-02T16:15:09.897",
         references: "[{\"url\": \"https://support.pentaho.com/hc/en-us/articles/6744743458701\", \"source\": \"security.vulnerabilities@hitachivantara.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://support.pentaho.com/hc/en-us/articles/6744743458701\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
         sourceIdentifier: "security.vulnerabilities@hitachivantara.com",
         vulnStatus: "Modified",
         weaknesses: "[{\"source\": \"security.vulnerabilities@hitachivantara.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}]}]",
      },
      nvd: "{\"cve\":{\"id\":\"CVE-2021-45448\",\"sourceIdentifier\":\"security.vulnerabilities@hitachivantara.com\",\"published\":\"2022-11-02T16:15:09.897\",\"lastModified\":\"2024-11-21T06:32:13.740\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Pentaho Business Analytics\\n Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho \\nAnalyzer plugin exposes a service endpoint for templates which allows a \\nuser-supplied path to access resources that are out of bounds. \\n\\nThe software uses external input to construct a pathname that is intended to identify a file or \\ndirectory that is located underneath a restricted parent directory, but the software does not \\nproperly neutralize special elements within the pathname that can cause the pathname to \\nresolve to a location that is outside of the restricted directory.  By using special elements such as \\n\\\"..\\\" and \\\"/\\\" separators, attackers can escape outside of the restricted \\nlocation to access files or directories that are elsewhere on the \\nsystem.\\n\\n\\n\\n\"},{\"lang\":\"es\",\"value\":\"Las versiones de Pentaho Business Analytics Server anteriores a 9.2.0.2 y 8.3.0.25 que utilizan el complemento Pentaho Analyzer exponen un endpoint de servicio para plantillas que permite una ruta proporcionada por el usuario para acceder a recursos que están fuera de los límites. El software utiliza entradas externas para construir un nombre de ruta destinado a identificar un archivo o directorio que se encuentra debajo de un directorio principal restringido, pero el software no neutraliza adecuadamente los elementos especiales dentro del nombre de ruta que pueden hacer que el nombre de ruta se resuelva en una ubicación que está fuera del directorio restringido. Al utilizar elementos especiales como separadores \\\"..\\\" y \\\"/\\\", los atacantes pueden escapar de la ubicación restringida para acceder a archivos o directorios que se encuentran en otras partes del sistema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security.vulnerabilities@hitachivantara.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":4.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security.vulnerabilities@hitachivantara.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hitachi:vantara_pentaho:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.3.0.0\",\"versionEndExcluding\":\"8.3.0.25\",\"matchCriteriaId\":\"AB67F45F-D25C-4B85-8819-433D89F3EF1F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hitachi:vantara_pentaho:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.2.0.0\",\"versionEndExcluding\":\"9.2.0.2\",\"matchCriteriaId\":\"111F5389-BE1D-480F-8229-3EEDF8F6D82A\"}]}]}],\"references\":[{\"url\":\"https://support.pentaho.com/hc/en-us/articles/6744743458701\",\"source\":\"security.vulnerabilities@hitachivantara.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://support.pentaho.com/hc/en-us/articles/6744743458701\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.