CVSS: 8.8EPSS: 40%CPEs: 2EXPL: 1CVE-2022-43769 – Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
https://notcve.org/view.php?id=CVE-2022-43769
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream. Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is vulnerable to an authentication bypass (CVE-2022-43939) and a Server Side Template Injection (SSTI) vulnerability (CVE-2022-43769) that can be chained together to achieve unauthenticated code execution as the user running the Pentaho Business Analytics Server. The first vulnerability (CVE-2022-43939) is an authentication bypass which stems from a regex that allows any URL that ends in "/", followed by "require", optionally "-js" or "-cfg", any character, and then the string "js" followed optionally by "?" and then any characters of the attacker's choice. The second (CVE-2022-43769) is a server side template injection. • https://www.exploit-db.com/exploits/51350 http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769- https://github.com/dwbzn/pentaho-exploits/blob/main/cve-2022-43769.py https://research.aurainfosec. • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0CVE-2020-36652 – File and Directory Permissions Vulnerability in Hitachi Automation Director, Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center
https://notcve.org/view.php?id=CVE-2020-36652
Incorrect Default Permissions vulnerability in Hitachi Automation Director on Linux, Hitachi Infrastructure Analytics Advisor on Linux (Hitachi Infrastructure Analytics Advisor, Analytics probe server components), Hitachi Ops Center Automator on Linux, Hitachi Ops Center Analyzer on Linux (Hitachi Ops Center Analyzer, Analyzer probe server components), Hitachi Ops Center Viewpoint on Linux (Viewpoint RAID Agent component) allows local users to read and write specific files. This issue affects Hitachi Automation Director: from 8.2.0-00 through 10.6.1-00; Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.0.0-00; Hitachi Ops Center Automator: before 10.9.1-00; Hitachi Ops Center Analyzer: before 10.9.1-00; Hitachi Ops Center Viewpoint: before 10.9.1-00. • https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-106/index.html • CWE-276: Incorrect Default Permissions •
CVSS: 8.6EPSS: 0%CPEs: 3EXPL: 0CVE-2022-4895 – Man-in-the-middle attack Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer
https://notcve.org/view.php?id=CVE-2022-4895
Improper Certificate Validation vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Analyzer probe component) allows Man in the Middle Attack.This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.1-00. • https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-105/index.html • CWE-295: Improper Certificate Validation •
CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-3884 – Directory Permission Vulnerability in Hitachi Ops Center Analyzer
https://notcve.org/view.php?id=CVE-2022-3884
Incorrect Default Permissions vulnerability in Hitachi Ops Center Analyzer on Windows (Hitachi Ops Center Analyzer RAID Agent component) allows local users to read and write specific files.This issue affects Hitachi Ops Center Analyzer: from 10.9.0-00 before 10.9.0-01. • https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-105/index.html • CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-4441 – Privilege Escalation Vulnerability in Hitachi Storage Plug-in for VMware vCenter
https://notcve.org/view.php?id=CVE-2022-4441
Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.9.0 before 04.9.1. Vulnerabilidad de asignación de privilegios incorrecta en Hitachi Storage Plug-in para VMware vCenter permite a los usuarios autenticados remotamente provocar una escalada de privilegios. Este problema afecta a Hitachi Storage Plug-in para VMware vCenter: desde 04.9.0 antes de 04.9.1. • https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-103/index.html • CWE-266: Incorrect Privilege Assignment CWE-269: Improper Privilege Management CWE-287: Improper Authentication •