high8.8
CVE-2021-31599
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x.
Impact
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. A reports (.prpt) file allows the inclusion of BeanShell scripts to ease the production of complex reports. An authenticated user can run arbitrary code.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hitachi | Vantara Pentaho | through 9.1.0.0 |
| Hitachi | Vantara Pentaho Business Intelligence Server | through 7.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/164772/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Remote-Code-Execution.html
- https://www.hitachi.com/hirt/security/index.html
- http://packetstormsecurity.com/files/164772/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Remote-Code-Execution.html
- https://www.hitachi.com/hirt/security/index.html