CVE-2021-34685: Malicious File Upload
UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upload various files of different file types. Specifically, a .jsp file is not allowed, but a .jsp. file is allowed (and leads to remote code execution).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-34685?
CVE-2021-34685 is considered a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2021-34685?
To fix CVE-2021-34685, update Hitachi Vantara Pentaho to a version beyond 9.1.0.0 where the vulnerability has been addressed.
Who is affected by CVE-2021-34685?
CVE-2021-34685 affects authenticated users of Hitachi Vantara Pentaho Business Analytics version 9.1.0.0 and earlier.
What could an attacker do with CVE-2021-34685?
An attacker could exploit CVE-2021-34685 to upload malicious files, potentially leading to remote code execution.
Is there a workaround for CVE-2021-34685?
As a temporary workaround for CVE-2021-34685, restrict file upload capabilities and monitor uploads to prevent unauthorized file types.