CVE-2022-3960
published 2023-04-03CVE-2022-3960: Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable…
PriorityP433medium6.3CVSS 3.1
AVNACLPRLUINSUCLILAL
EPSS
0.45%
36.1th percentile
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hitachi | vantara_pentaho_business_analytics_server | < 9.3.0.2 | 9.3.0.2 |
| hitachi | vantara_pentaho_business_analytics_server | — | — |
| hitachi_vantara | pentaho_business_analytics_server | >= 1.0 < 9.3.0.2 | 9.3.0.2 |
| hitachi_vantara | pentaho_business_analytics_server | >= 9.4.0.0 < 9.4.0.1 | 9.4.0.1 |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
cisa6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q552-8jxx-pwh8: Hitachi Vantara Pentaho Business Analytics Server prior to versions 9
ghsa_unreviewed·2023-04-03
CVE-2022-3960 [MEDIUM] CWE-94 GHSA-q552-8jxx-pwh8: Hitachi Vantara Pentaho Business Analytics Server prior to versions 9
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin.
CISA
Adobe BlazeDS Information Disclosure Vulnerability
cisa·2022-03-07·CVSS 6.5
CVE-2009-3960 [MEDIUM] Adobe BlazeDS Information Disclosure Vulnerability
Vulnerability: Adobe BlazeDS Information Disclosure Vulnerability
Affected: Adobe BlazeDS
Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2009-3960
Remediation Due Date: 2022-09-07
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://support.pentaho.com/hc/en-us/articles/14456813547917--Resolved-Pentaho-BA-Server-Improper-Neutralization-of-Directives-in-Statically-Saved-Code-Static-Code-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-CVE-2022-3960-https://support.pentaho.com/hc/en-us/articles/14456813547917--Resolved-Pentaho-BA-Server-Improper-Neutralization-of-Directives-in-Statically-Saved-Code-Static-Code-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-CVE-2022-3960-
2023-04-03
Published