var-202305-2206
Vulnerability from variot

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list. Hitachi Vantara's Vantara Pentaho and Pentaho Business Analytics Exists in a fraudulent authentication vulnerability.Information may be obtained

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202305-2206",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "vantara pentaho business analytics server",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "hitachi",
        "version": "9.3.0.0"
      },
      {
        "model": "vantara pentaho business analytics server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hitachi",
        "version": "9.4.0.0"
      },
      {
        "model": "vantara pentaho",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "hitachi",
        "version": "8.3.0.25"
      },
      {
        "model": "vantara pentaho business analytics server",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "hitachi",
        "version": "9.3.0.3"
      },
      {
        "model": "vantara pentaho",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "hitachi",
        "version": "8.3.0.0"
      },
      {
        "model": "vantara pentaho",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u65e5\u7acb\u30f4\u30a1\u30f3\u30bf\u30e9",
        "version": "8.3.0.0  to  8.3.0.25"
      },
      {
        "model": "pentaho business analytics",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u65e5\u7acb\u30f4\u30a1\u30f3\u30bf\u30e9",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "cve": "CVE-2023-1158",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "id": "CVE-2023-1158",
            "impactScore": 1.4,
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.3,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2023-1158",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2023-1158",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "security.vulnerabilities@hitachivantara.com",
            "id": "CVE-2023-1158",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2023-1158",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202305-2171",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "\nHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list. Hitachi Vantara\u0027s Vantara Pentaho and Pentaho Business Analytics Exists in a fraudulent authentication vulnerability.Information may be obtained",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "VULMON",
        "id": "CVE-2023-1158"
      }
    ],
    "trust": 1.71
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2023-1158",
        "trust": 3.3
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2023-1158",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2023-1158"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "id": "VAR-202305-2206",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 1.0
  },
  "last_update_date": "2024-08-14T13:41:47.758000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "(Resolved)\u00a0Pentaho\u00a0BA\u00a0Server\u00a0-\u00a0Incorrect\u00a0Authorization\u00a0-\u00a0Versions\u00a0before\u00a09.4.0.1\u00a0and\u00a09.3.0.3,\u00a0including\u00a08.3.x\u00a0Impacted\u00a0(CVE-2023-1158)",
        "trust": 0.8,
        "url": "https://support.pentaho.com/hc/en-us/articles/14456024873741-IMPORTANT-Resolved-Pentaho-BA-Server-Incorrect-Authorization-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2023-1158-"
      },
      {
        "title": "Hitachi Vantara Pentaho Business Analytics Server Security vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=240066"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-863",
        "trust": 1.0
      },
      {
        "problemtype": "Illegal authentication (CWE-863) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://support.pentaho.com/hc/en-us/articles/14456024873741-important-resolved-pentaho-ba-server-incorrect-authorization-versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-impacted-cve-2023-1158-"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2023-1158"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2023-1158/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2023-1158"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2023-1158"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-05-24T00:00:00",
        "db": "VULMON",
        "id": "CVE-2023-1158"
      },
      {
        "date": "2024-01-24T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "date": "2023-05-24T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      },
      {
        "date": "2023-05-24T22:15:09.123000",
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-05-25T00:00:00",
        "db": "VULMON",
        "id": "CVE-2023-1158"
      },
      {
        "date": "2024-01-24T04:31:00",
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      },
      {
        "date": "2023-06-02T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      },
      {
        "date": "2023-06-01T16:05:50.803000",
        "db": "NVD",
        "id": "CVE-2023-1158"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Hitachi Vantara\u0027s \u00a0Vantara\u00a0Pentaho\u00a0 and \u00a0Pentaho\u00a0Business\u00a0Analytics\u00a0 Fraud related to unauthorized authentication in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-022742"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202305-2171"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.