CVE-2021-34684: SQL Injection
Published Nov 8, 2021
·Updated
Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data source and thus retrieve data from the related databases, as demonstrated by an api/repos/dashboards/editor URI.
Affected Software
1 affected component
Hitachi Vantara Pentaho<=9.1.0.0
Event History
Nov 8, 2021
CVE Published
via MITRE·03:34 AM
Data Sourced
via MITRE·03:34 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2021-34684?
CVE-2021-34684 has been assigned a high severity due to the potential for unauthorized SQL query execution.
2
How do I fix CVE-2021-34684?
To mitigate CVE-2021-34684, users should update their Hitachi Vantara Pentaho software to a version later than 9.1.0.0.
3
Which versions of Hitachi Vantara Pentaho are affected by CVE-2021-34684?
CVE-2021-34684 affects Hitachi Vantara Pentaho versions up to and including 9.1.0.0.
4
What type of vulnerability is CVE-2021-34684?
CVE-2021-34684 is classified as a SQL injection vulnerability.
5
Can CVE-2021-34684 be exploited remotely?
Yes, CVE-2021-34684 can be exploited by an unauthenticated remote user.