CVE-2021-45446: Pentaho Business Analytics Server - Exposure of Information Through Directory Listing
Published Nov 2, 2022
·Updated
A vulnerability in
Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 does not cascade the hidden property to the children of the Home folder. This directory listing provides an attacker with the complete index of all the resources located inside the directory.
Affected Software
2 affected components
Hitachi Vantara Pentaho>=8.3.0.0<8.3.0.25
Hitachi Vantara Pentaho>=9.2.0.0<9.2.0.2
Event History
Nov 2, 2022
CVE Published
via MITRE·02:26 PM
Data Sourced
via MITRE·02:26 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2021-45446.
2
What software versions are affected by CVE-2021-45446?
Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 are affected.
3
What is the severity of CVE-2021-45446?
The severity of CVE-2021-45446 is high with a CVSS score of 7.5.
4
How does CVE-2021-45446 affect the system?
CVE-2021-45446 allows an attacker to view the complete index of all the resources located inside the directory of the Home folder.
5
Is there a fix available for CVE-2021-45446?
Yes, a fix is available. Update Hitachi Vantara Pentaho Business Analytics Server to version 9.2.0.2 or 8.3.0.25.