Login Request a demo
Critical severity · published Nov 8, 2021
CVE-2021-34684
Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data source and thus retrieve data from the…
9.8
CVSS
5.9%
EPSS
No
On KEV
Description
Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data source and thus retrieve data from the related databases, as demonstrated by an api/repos/dashboards/editor URI.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.9% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VP
Vantara Pentaho · Hitachi
through 9.1.0.0 · source: NVD
Affected product
VP
Vantara Pentaho
Hitachi
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-34684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-34684
Exploit
http://packetstormsecurity.com/files/164791/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-SQL-Injection.html
Vendor Advisory
https://www.hitachi.com/hirt/security/index.html
More from Vantara Pentaho
8.8
CVE-2022-4815
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved…
8.8
CVE-2021-31599
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x
7.5
CVE-2021-45447
Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear text
7.5
CVE-2021-45446
Pentaho Business Analytics Server - Exposure of Information Through Directory Listing
7.5
CVE-2021-31602
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x