- Description
- A vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 does not cascade the hidden property to the children of the Home folder. This directory listing provides an attacker with the complete index of all the resources located inside the directory.
- Source
- security.vulnerabilities@hitachivantara.com
- NVD status
- Modified
CVSS 3.1
- Type
- Primary
- Base score
- 7.5
- Impact score
- 3.6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity
- HIGH
- Hype score
- Not currently trending
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:hitachi:vantara_pentaho:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB67F45F-D25C-4B85-8819-433D89F3EF1F",
"versionEndExcluding": "8.3.0.25",
"versionStartIncluding": "8.3.0.0"
},
{
"criteria": "cpe:2.3:a:hitachi:vantara_pentaho:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "111F5389-BE1D-480F-8229-3EEDF8F6D82A",
"versionEndExcluding": "9.2.0.2",
"versionStartIncluding": "9.2.0.0"
}
],
"operator": "OR"
}
]
}
]