CVEvulnerability

CVE-2021-45446

7.5 HIGH Published 2022-11-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-11-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.0 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-281, CWE-548

Description

A vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 does not cascade the hidden property to the children of the Home folder.  This directory listing provides an attacker with the complete index of all the resources located inside the directory.

Affected configurations

• hitachi vantara pentaho (>= 8.3.0.0 < 8.3.0.25) • hitachi vantara pentaho (>= 9.2.0.0 < 9.2.0.2)

Related

Weakness · CWE (2)

  • CWE-281 Improper Preservation of Permissions weakness
  • CWE-548 Exposure of Information Through Directory Listing weakness

References