VAR-202305-2206

Vulnerability from variot - Updated: 2024-01-25 23:02

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list. Hitachi Vantara's Vantara Pentaho and Pentaho Business Analytics Exists in a fraudulent authentication vulnerability.Information may be obtained

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202305-2206",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "vantara pentaho business analytics server",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "hitachi",
        "version": "9.3.0.0"
      },
      {
        "model": "vantara pentaho business analytics server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hitachi",
        "version": "9.4.0.0"
      },
      {
        "model": "vantara pentaho",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "hitachi",
        "version": "8.3.0.25"
      },
      {
        "model": "vantara pentaho business analytics server",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "hitachi",
        "version": "9.3.0.3"
      },
      {
        "model": "vantara pentaho",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "hitachi",
        "version": "8.3.0.0"
      },
      {
        "model": "vantara pentaho",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u65e5\u7acb\u30f4\u30a1\u30f3\u30bf\u30e9",
        "version": "8.3.0.0  to  8.3.0.25"
      },
      {
        "model": "pentaho business analytics",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u65e5\u7acb\u30f4\u30a1\u30f3\u30bf\u30e9",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:hitachi:vantara_pentaho_business_analytics_server:9.4.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:hitachi:vantara_pentaho_business_analytics_server:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "9.3.0.3",
                "versionStartIncluding": "9.3.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:hitachi:vantara_pentaho:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "8.3.0.25",
                "versionStartIncluding": "8.3.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "cve": "CVE-2023-1158",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "impactScore": 1.4,
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.3,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2023-1158",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2023-1158",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "security.vulnerabilities@hitachivantara.com",
            "id": "CVE-2023-1158",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202305-2171",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "\nHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list. Hitachi Vantara\u0027s Vantara Pentaho and Pentaho Business Analytics Exists in a fraudulent authentication vulnerability.Information may be obtained",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "VULMON",
        "id": "CVE-2023-1158"
      }
    ],
    "trust": 1.71
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2023-1158",
        "trust": 3.3
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2023-1158",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2023-1158"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "id": "VAR-202305-2206",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 1.0
  },
  "last_update_date": "2024-01-25T23:02:54.140000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "(Resolved)\u00a0Pentaho\u00a0BA\u00a0Server\u00a0-\u00a0Incorrect\u00a0Authorization\u00a0-\u00a0Versions\u00a0before\u00a09.4.0.1\u00a0and\u00a09.3.0.3,\u00a0including\u00a08.3.x\u00a0Impacted\u00a0(CVE-2023-1158)",
        "trust": 0.8,
        "url": "https://support.pentaho.com/hc/en-us/articles/14456024873741-important-resolved-pentaho-ba-server-incorrect-authorization-versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-impacted-cve-2023-1158-"
      },
      {
        "title": "Hitachi Vantara Pentaho Business Analytics Server Security vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=240066"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-863",
        "trust": 1.0
      },
      {
        "problemtype": "Illegal authentication (CWE-863) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://support.pentaho.com/hc/en-us/articles/14456024873741-important-resolved-pentaho-ba-server-incorrect-authorization-versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-impacted-cve-2023-1158-"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2023-1158"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2023-1158/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2023-1158"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2023-1158"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-05-24T00:00:00",
        "db": "VULMON",
        "id": "CVE-2023-1158"
      },
      {
        "date": "2024-01-24T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "date": "2023-05-24T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      },
      {
        "date": "2023-05-24T22:15:09.123000",
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-05-25T00:00:00",
        "db": "VULMON",
        "id": "CVE-2023-1158"
      },
      {
        "date": "2024-01-24T04:31:00",
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "date": "2023-06-02T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      },
      {
        "date": "2023-06-01T16:05:50.803000",
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Hitachi Vantara\u0027s \u00a0Vantara\u00a0Pentaho\u00a0 and \u00a0Pentaho\u00a0Business\u00a0Analytics\u00a0 Fraud related to unauthorized authentication in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.