Critical Flaws Uncovered in Pentaho Business Analytics Software

guest · Nov 1, 2021

Critical Flaws Uncovered in Pentaho Business Analytics Software
November 1, 2021
https://thehackernews.com/2021/11/critical-flaws-uncovered-in-pentaho.html

Multiple vulnerabilities have been disclosed in Hitachi Vantara's Pentaho Business Analytics software that could be abused by malicious actors to upload arbitrary data files and even execute arbitrary code on the underlying host system of the application.

The security weaknesses were reported by researchers Alberto Favero from German cybersecurity firm Hawsec and Altion Malka from Census Labs earlier this year, prompting the company to issue necessary patches to address the issues.
Click to expand...

Pentaho is a Java-based business intelligence platform that offers data integration, analytics, online analytical processing (OLAP), and mining capabilities, and counts major companies and organizations like Bell, CERN, Cipal, Logitech, Nasdaq, Telefonica, Teradata, and the National September 11 Memorial and Museum among its customers.
Click to expand...

Successful exploitation of the flaws could allow authenticated users with sufficient role permissions to upload and run Pentaho Report Bundles to run malicious code on the host server and exfiltrate sensitive application data, and circumvent filename extension restrictions enforced by the application and upload files of any type.
Click to expand...

Log in or Sign up

Critical Flaws Uncovered in Pentaho Business Analytics Software

guest Guest

Log in or Sign up

Critical Flaws Uncovered in Pentaho Business Analytics Software

guest Guest

Useful Searches