CVE-2022-43941 — Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference

Description (CNA)

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference.

Affected (CNA)

Vendor / product	Versions
Hitachi Vantara / Pentaho Business Analytics Server	affected 1.0 before 9.3.0.2; affected 9.4.0.0 before 9.4.0.1

CWE

CWE-611

References

https://support.pentaho.com/hc/en-us/articles/14456719346957--Resolved-Pentaho-BA-Server-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-CVE-2022-43941-

ADP enrichment

CVE

No English description supplied.

https://support.pentaho.com/hc/en-us/articles/14456719346957--Resolved-Pentaho-BA-Server-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-CVE-2022-43941-

CISA-ADP

No English description supplied.

No references supplied.