THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Fathom (Privacy friendly web analytics)
Zendesk (Helpdesk and Chat)

Ok

Home | EN
Support
CVE
PUBLISHED

CVE-2024-28982

Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference

AssignerHITVAN
Reserved2024-03-13
Published2024-06-26
Updated2024-07-09

Description

Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of the Pentaho User Console against XML External Entity Reference.



HIGH: 7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Problem types

CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Product status

Default status
unaffected

1.0 before 9.3.0.7
affected

8.3 before 10.1.0.0
affected

References

https://support.pentaho.com/hc/en-us/articles/27569195609869--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Restriction-of-XML-External-Entity-Reference-versions-before-10-1-0-0-and-9-3-0-7-including-8-3-x-Impacted-CVE-2024-28982

cve.org CVE-2024-28982

nvd.nist.gov CVE-2024-28982

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-28982
© Copyright 2024 THREATINT. Made in Cyprus with +