CVE-2023-1158 — Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization

Description (CNA)

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list.

Affected (CNA)

Vendor / product	Versions
Hitachi Vantara / Pentaho Business Analytics Server	affected 1.0 before 9.3.0.3; affected 9.4.0.0 before 9.4.0.1

CWE

CWE-863

References

https://support.pentaho.com/hc/en-us/articles/14456024873741-IMPORTANT-Resolved-Pentaho-BA-Server-Incorrect-Authorization-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2023-1158-

ADP enrichment

CVE

No English description supplied.

https://support.pentaho.com/hc/en-us/articles/14456024873741-IMPORTANT-Resolved-Pentaho-BA-Server-Incorrect-Authorization-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2023-1158-

CISA-ADP

No English description supplied.

No references supplied.