Multiple vulnerabilities in Hitachi Vantara Pentaho
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 5 |
| CVE-ID | CVE-2020-24670 CVE-2020-24664 CVE-2020-24665 CVE-2020-24666 CVE-2020-24669 |
| CWE-ID | CWE-79 CWE-776 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Vantara Pentaho Server applications / Other server solutions |
| Vendor |
Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
1) Cross-site scripting
EUVDB-ID: #VU50237
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-24670
CWE-ID:
Exploit availability:
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the Dashboard Editor within the "type" attribute of "dashboardXml" parameter. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall update from vendor's website.
Vulnerable software versionsVantara Pentaho: before 8.3.0.0 GA
Fixed software versionsCPE2.3 External links
http://www.hitachi.com/hirt/hitachi-sec/2020/601.html
http://www.accenture.com
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
2) Cross-site scripting
EUVDB-ID: #VU50241
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-24664
CWE-ID:
Exploit availability:
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the Dashboard Editor within the "pho:title" attribute of "dashboardXml" parameter. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall update from vendor's website.
Vulnerable software versionsVantara Pentaho: before 8.3.0.0 GA
Fixed software versionsCPE2.3 External links
http://www.hitachi.com/hirt/hitachi-sec/2020/601.html
http://www.accenture.com
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
3) XML Entity Expansion
EUVDB-ID: #VU50240
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2020-24665
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform a denial o service (DoS) attack.
The vulnerability exists due to improper restrictions on XML entities in the Dashboard Editor. A remote authenticated attacker can send a specially crafted request and cause a denial of service condition on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsVantara Pentaho: before 8.3.0.0 GA
Fixed software versionsCPE2.3 External links
http://www.hitachi.com/hirt/hitachi-sec/2020/601.html
http://www.accenture.com
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
4) Stored cross-site scripting
EUVDB-ID: #VU50239
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-24666
CWE-ID:
Exploit availability:
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the Analysis Report in "Display Name" parameter. A remote authenticated attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall update from vendor's website.
Vulnerable software versionsVantara Pentaho: before 9.1.0.1
Fixed software versionsCPE2.3 External links
http://www.hitachi.com/hirt/hitachi-sec/2020/601.html
http://www.accenture.com
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
5) Cross-site scripting
EUVDB-ID: #VU50238
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-24669
CWE-ID:
Exploit availability:
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the New Analysis Report within the "Analysis Report Description" field in "About this Report" section. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall update from vendor's website.
Vulnerable software versionsVantara Pentaho: before 9.1.0.0 GA
Fixed software versionsCPE2.3 External links
http://www.hitachi.com/hirt/hitachi-sec/2020/601.html
http://www.accenture.com
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
