CVE-2021-45446 — Pentaho Business Analytics Server - Exposure of Information Through Directory Listing

CVE-2021-45446

Pentaho Business Analytics Server - Exposure of Information Through Directory Listing PUBLISHED

Description (CNA)

A vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 does not cascade the hidden property to the children of the Home folder. This directory listing provides an attacker with the complete index of all the resources located inside the directory.

Affected (CNA)

Vendor / product	Versions
Hitachi Vantara / Pentaho Business Analytics Server	affected 1.0 before 8.3.0.25; affected 9.0 before 9.2.0.2

CWE

CWE-548

References

https://support.pentaho.com/hc/en-us/articles/6744813983501

ADP enrichment

CVE

No English description supplied.

https://support.pentaho.com/hc/en-us/articles/6744813983501

CISA-ADP

No English description supplied.

No references supplied.