166 lines
6.7 KiB
JSON
166 lines
6.7 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2021-45446",
|
||
"assignerOrgId": "dce6e192-ff49-4263-9134-f0beccb9bc13",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "HITVAN",
|
||
"requesterUserId": "520cc88b-a1c8-44f6-9154-21a4d74c769f",
|
||
"dateReserved": "2021-12-21T05:57:40.703Z",
|
||
"datePublished": "2022-11-02T14:26:02.105Z",
|
||
"dateUpdated": "2025-05-02T15:52:28.178Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "Pentaho Business Analytics Server",
|
||
"vendor": "Hitachi Vantara",
|
||
"versions": [
|
||
{
|
||
"lessThan": "8.3.0.25",
|
||
"status": "affected",
|
||
"version": "1.0",
|
||
"versionType": "ALL"
|
||
},
|
||
{
|
||
"lessThan": "9.2.0.2",
|
||
"status": "affected",
|
||
"version": "9.0",
|
||
"versionType": "ALL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "A vulnerability in \n\nHitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and \n8.3.0.25 does not cascade the hidden property to the children of the Home folder. This directory listing provides an attacker with the complete index of all the resources located \ninside the directory. \n\n<br>"
|
||
}
|
||
],
|
||
"value": "A vulnerability in \n\nHitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and \n8.3.0.25 does not cascade the hidden property to the children of the Home folder. This directory listing provides an attacker with the complete index of all the resources located \ninside the directory. \n\n\n"
|
||
}
|
||
],
|
||
"impacts": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "A directory listing provides an attacker with the complete index of all the resources located inside of the directory. The specific risks and consequences vary depending on which files are listed and accessible."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "NETWORK",
|
||
"availabilityImpact": "NONE",
|
||
"baseScore": 5,
|
||
"baseSeverity": "MEDIUM",
|
||
"confidentialityImpact": "LOW",
|
||
"integrityImpact": "NONE",
|
||
"privilegesRequired": "LOW",
|
||
"scope": "CHANGED",
|
||
"userInteraction": "NONE",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
|
||
"version": "3.1"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-548",
|
||
"description": "CWE-548",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "dce6e192-ff49-4263-9134-f0beccb9bc13",
|
||
"shortName": "HITVAN",
|
||
"dateUpdated": "2022-11-02T14:26:02.105Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"url": "https://support.pentaho.com/hc/en-us/articles/6744813983501"
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "UNKNOWN"
|
||
},
|
||
"title": " Pentaho Business Analytics Server - Exposure of Information Through Directory Listing",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.1.0-dev"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-04T04:39:20.999Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://support.pentaho.com/hc/en-us/articles/6744813983501",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2025-05-02T15:52:14.221510Z",
|
||
"id": "CVE-2021-45446",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2025-05-02T15:52:28.178Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |