CVE-2021-31599
Pentaho Business Analytics / Pentaho Business Server 9.1 Remote Code Execution
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. A reports (.prpt) file allows the inclusion of BeanShell scripts to ease the production of complex reports. An authenticated user can run arbitrary code.
Se ha detectado un problema en Hitachi Vantara Pentaho versiones hasta 9.1 y en Pentaho Business Intelligence Server versiones hasta 7.x. Un archivo de informes (.prpt) permite una inclusión de scripts BeanShell para facilitar la producción de informes complejos. Un usuario autenticado puede ejecutar código arbitrario
Pentaho allows users to create and run Pentaho Report Bundles (.prpt). Users can create PRPT reports by utilizing the Pentaho Designer application and can include BeanShell Script functions to ease the production of complex reports. However, the BeanShell Script functions can allow for the execution of arbitrary Java code when Pentaho PRPT Reports are run by Pentaho Business Analytics. This functionality allows any user with sufficient privileges to upload or edit an existing Pentaho Report Bundle (through Pentaho Designer) and execute arbitrary code in the context of the Pentaho application user running on the web server.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-04-23 CVE Reserved
- 2021-11-05 CVE Published
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- 2024-09-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
References (2)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
http://packetstormsecurity.com/files/164772/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Remote-Code-Execution.html | 2024-08-03 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://www.hitachi.com/hirt/security/index.html | 2021-11-09 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Hitachi Search vendor "Hitachi" | Vantara Pentaho Search vendor "Hitachi" for product "Vantara Pentaho" | <= 9.1.0.0 Search vendor "Hitachi" for product "Vantara Pentaho" and version " <= 9.1.0.0" | - |
Affected
| ||||||
Hitachi Search vendor "Hitachi" | Vantara Pentaho Business Intelligence Server Search vendor "Hitachi" for product "Vantara Pentaho Business Intelligence Server" | <= 7.1 Search vendor "Hitachi" for product "Vantara Pentaho Business Intelligence Server" and version " <= 7.1" | - |
Affected
|