Vulnerability Description
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. A reports (.prpt) file allows the inclusion of BeanShell scripts to ease the production of complex reports. An authenticated user can run arbitrary code.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hitachi | Vantara Pentaho | <= 9.1.0.0 |
| Hitachi | Vantara Pentaho Business Intelligence Server | <= 7.1 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/164772/Pentaho-Business-Analytics-Pentaho-BExploitThird Party AdvisoryVDB Entry
- https://www.hitachi.com/hirt/security/index.htmlVendor Advisory
- http://packetstormsecurity.com/files/164772/Pentaho-Business-Analytics-Pentaho-BExploitThird Party AdvisoryVDB Entry
- https://www.hitachi.com/hirt/security/index.htmlVendor Advisory
FAQ
What is CVE-2021-31599?
CVE-2021-31599 is a vulnerability with a CVSS score of 8.8 (HIGH). An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. A reports (.prpt) file allows the inclusion of BeanShell scripts to ease the produc...
How severe is CVE-2021-31599?
CVE-2021-31599 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-31599?
Check the references section above for vendor advisories and patch information. Affected products include: Hitachi Vantara Pentaho, Hitachi Vantara Pentaho Business Intelligence Server.