CVE-2021-45446: A vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 does not cascade the hidden property to the children…

PriorityP339high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EPSS

0.41%

33.0th percentile

A vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 does not cascade the hidden property to the children of the Home folder. This directory listing provides an attacker with the complete index of all the resources located inside the directory.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
hitachi	vantara_pentaho	>= 8.3.0.0 < 8.3.0.25	8.3.0.25
hitachi	vantara_pentaho	>= 9.2.0.0 < 9.2.0.2	9.2.0.2
hitachi_vantara	pentaho_business_analytics_server	>= 1.0 < 8.3.0.25	8.3.0.25
hitachi_vantara	pentaho_business_analytics_server	>= 9.0 < 9.2.0.2	9.2.0.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.