deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-26112
Published: 2023-04-03
Description: All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\).**Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.
CVSS Score: 3.7 (LOW)
CWE: CWE-1333, CWE-1333
References: https://github.com/DiffSK/configobj/issues/232; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BO4RLMYEJODCNUE3DJIIUUFVTPAG6VN/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZHY7B33EFY4LESP2NI4APQUPRROTAZK/
CVE: CVE-2023-26119
Published: 2023-04-03
Description: Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/HtmlUnit/htmlunit/commit/641325bbc84702dc9800ec7037aec061ce21956b; https://security.snyk.io/vuln/SNYK-JAVA-NETSOURCEFORGEHTMLUNIT-3252500; https://siebene.github.io/2022/12/30/HtmlUnit-RCE/
CVE: CVE-2023-26269
Published: 2023-04-03
Description: Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a 
malicious local user.

Administrators are advised to disable JMX, or set up a JMX password.

Note that version 3.7.4 onward will set up a JMX password automatically for Guice users.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2023/04/18/3; https://lists.apache.org/thread/2z44rg93pflbjhvbwy3xtz505bx41cbs; http://www.openwall.com/lists/oss-security/2023/04/18/3
CVE: CVE-2023-26529
Published: 2023-04-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DupeOff.Com DupeOff plugin <= 1.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/dupeoff/wordpress-dupeoff-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dupeoff/wordpress-dupeoff-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-27665
Published: 2023-04-03
Description: Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. This can lead to execution of malicious code and commands on the client due to improper handling of user-provided input. By inputting malicious payloads in the subdirectory searchbar or Add folder filename boxes, it is possible to execute client-side commands. For example, there is Client-Side Template Injection via subFolderPath to the ThinClient/WtmApiService.asmx/GetFileSubTree URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023; https://docs.ipswitch.com/WS_FTP_Server2020/ReleaseNotes/index.htm; https://github.com/dievus/CVE-2022-27665
CVE: CVE-2023-1765
Published: 2023-04-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Akbim Computer Panon allows SQL Injection.This issue affects Panon: before 1.0.2.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0193; https://www.usom.gov.tr/bildirim/tr-23-0193
CVE: CVE-2023-1766
Published: 2023-04-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Akbim Computer Panon allows Reflected XSS.This issue affects Panon: before 1.0.2.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0193; https://www.usom.gov.tr/bildirim/tr-23-0193
CVE: CVE-2023-28625
Published: 2023-04-03
Description: mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/OpenIDC/mod_auth_openidc/blame/3f11976dab56af0a46a7dddb7a275cc16d6eb726/src/mod_auth_openidc.c#L178-L179; https://github.com/OpenIDC/mod_auth_openidc/commit/c0e1edac3c4c19988ccdc7713d7aebfce6ff916a; https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.13.2
CVE: CVE-2022-38922
Published: 2023-04-03
Description: BluePage CMS thru 3.9 processes an insufficiently sanitized HTTP Header Cookie value allowing MySQL Injection in the 'users-cookie-settings' token using a Time-based blind SLEEP payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/dtssec/CVE-Disclosures/blob/main/CVE-2022-38922_CVE-2022-38923_Bluepage_CMS_SQLi/CVE-2022-38922-BluePage_CMS_3.9.md; https://www.bluepage-cms.com/index.php; https://www.iss-oberlausitz.de/index.php
CVE: CVE-2022-38923
Published: 2023-04-03
Description: BluePage CMS thru v3.9 processes an insufficiently sanitized HTTP Header allowing MySQL Injection in the 'User-Agent' field using a Time-based blind SLEEP payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/dtssec/CVE-Disclosures/blob/main/CVE-2022-38922_CVE-2022-38923_Bluepage_CMS_SQLi/CVE-2022-38922-BluePage_CMS_3.9.md; https://www.bluepage-cms.com/index.php; https://www.iss-oberlausitz.de/index.php
CVE: CVE-2023-0399
Published: 2023-04-03
Description: The Image Over Image For WPBakery Page Builder WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/702d7bbe-93cc-4bc2-b41d-cb66e08c99a7; https://wpscan.com/vulnerability/702d7bbe-93cc-4bc2-b41d-cb66e08c99a7
CVE: CVE-2023-0820
Published: 2023-04-03
Description: The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/b93d9f9d-0fd9-49b8-b465-d32b95351912; https://wpscan.com/vulnerability/b93d9f9d-0fd9-49b8-b465-d32b95351912
CVE: CVE-2023-1124
Published: 2023-04-03
Description: The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.
CVSS Score: 7.2 (HIGH)
CWE: CWE-552
References: https://wpscan.com/vulnerability/229b93cd-544b-4877-8d9f-e6debda9511c; https://wpscan.com/vulnerability/229b93cd-544b-4877-8d9f-e6debda9511c
CVE: CVE-2023-1330
Published: 2023-04-03
Description: The Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirect, which could allow attackers to add redirects via a CSRF attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/de4cff6d-0030-40e6-8221-fef56e12b4de; https://wpscan.com/vulnerability/de4cff6d-0030-40e6-8221-fef56e12b4de
CVE: CVE-2023-1377
Published: 2023-04-03
Description: The Solidres WordPress plugin through 0.9.4 does not sanitise and escape numerous parameter before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/c346ff80-c16b-4219-8983-708c64fa4a61; https://wpscan.com/vulnerability/c346ff80-c16b-4219-8983-708c64fa4a61
CVE: CVE-2022-36440
Published: 2023-04-03
Description: A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function. Attackers can maliciously construct BGP open packets and send them to BGP peers running frr-bgpd, resulting in DoS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/spwpun/pocs; https://github.com/spwpun/pocs/blob/main/frr-bgpd.md; https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html
CVE: CVE-2022-38072
Published: 2023-04-03
Description: An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and v0.98.4. A specially-crafted stl file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-118, CWE-129
References: https://github.com/admesh/admesh/commit/5fab257268a0ee6f832c18d72af89810a29fbd5f; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1594; https://github.com/admesh/admesh/commit/5fab257268a0ee6f832c18d72af89810a29fbd5f
CVE: CVE-2023-0975
Published: 2023-04-03
Description: 
A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, during install/upgrade workflow, to replace one of the Agent’s executables before it can be executed. This allows the user to elevate their permissions.


CVSS Score: 8.2 (HIGH)
CWE: CWE-281, CWE-281
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10396; https://kcm.trellix.com/corporate/index?page=content&id=SB10396
CVE: CVE-2023-0977
Published: 2023-04-03
Description: 
A heap-based overflow vulnerability in Trellix Agent (Windows and Linux) version 5.7.8 and earlier, allows a remote user to alter the page heap in the macmnsvc process memory block resulting in the service becoming unavailable.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-787
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10396; https://kcm.trellix.com/corporate/index?page=content&id=SB10396
CVE: CVE-2023-28834
Published: 2023-04-03
Description: Nextcloud Server is an open source personal cloud server. Nextcloud Server 24.0.0 until 24.0.6 and 25.0.0 until 25.0.4, as well as Nextcloud Enterprise Server 23.0.0 until 23.0.11, 24.0.0 until 24.0.6, and 25.0.0 until 25.0.4, have an information disclosure vulnerability. A user was able to get the full data directory path of the Nextcloud server from an API endpoint. By itself this information is not problematic as it can also be guessed for most common setups, but it could speed up other unknown attacks in the future if the information is known. Nextcloud Server 24.0.6 and 25.0.4 and Nextcloud Enterprise Server 23.0.11, 24.0.6, and 25.0.4 contain patches for this issue. There are no known workarounds.
CVSS Score: 3.5 (LOW)
CWE: CWE-212
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5w64-6c42-rgcv; https://github.com/nextcloud/server/issues/33883; https://github.com/nextcloud/server/pull/36094
CVE: CVE-2023-28836
Published: 2023-04-03
Description: Wagtail is an open source content management system built on Django. Starting in version 1.5 and prior to versions 4.1.4 and 4.2.2, a stored cross-site scripting (XSS) vulnerability exists on ModelAdmin views within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft pages and documents that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites with ModelAdmin enabled. For page, the vulnerability is in the "Choose a parent page" ModelAdmin view (`ChooseParentView`), available when managing pages via ModelAdmin. For documents, the vulnerability is in the ModelAdmin Inspect view (`InspectView`) when displaying document fields. Patched versions have been released as Wagtail 4.1.4 and Wagtail 4.2.2. Site owners who are unable to upgrade to the new versions can disable or override the corresponding functionality.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#customising-chooseparentview; https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#enabling-customising-inspectview; https://github.com/wagtail/wagtail/commit/5be2b1ed55fd7259dfdf2c82e7701dba407b8b62
CVE: CVE-2023-28837
Published: 2023-04-03
Description: Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and documents, files are loaded into memory during upload for additional processing. A user with access to upload images or documents through the Wagtail admin interface could upload a file so large that it results in a crash of denial of service.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. It can only be exploited by admin users with permission to upload images or documents.

Image uploads are restricted to 10MB by default, however this validation only happens on the frontend and on the backend after the vulnerable code. 

Patched versions have been released as Wagtail 4.1.4 and Wagtail 4.2.2). Site owners who are unable to upgrade to the new versions are encouraged to add extra protections outside of Wagtail to limit the size of uploaded files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://docs.wagtail.org/en/stable/reference/settings.html#wagtailimages-max-upload-size; https://github.com/wagtail/wagtail/commit/3c0c64642b9e5b8d28b111263c7f4bddad6c3880; https://github.com/wagtail/wagtail/commit/c9d2fcd650a88d76ae[PII_REDACTED]5e5927a9165
CVE: CVE-2022-43769
Published: 2023-04-03
Description: Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74, CWE-94
References: http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769-; http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html
CVE: CVE-2022-43773
Published: 2023-04-03
Description: 
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configured with stored procedures enabled. 


CVSS Score: 8.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]165--Resolved-Pentaho-BA-Server-Incorrect-Permission-Assignment-for-Critical-Resource-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43773-; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]165--Resolved-Pentaho-BA-Server-Incorrect-Permission-Assignment-for-Critical-Resource-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43773-
CVE: CVE-2023-28850
Published: 2023-04-03
Description: Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Version 1.5.1 has a patch. As a workaround, one may apply the patch manually.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/perspective-editor/pull/121.patch; https://github.com/pimcore/perspective-editor/security/advisories/GHSA-fq8q-55v3-2986; https://huntr.dev/bounties/5529f51e-e40f-46f1-887b-c9dbebab4f06/
CVE: CVE-2023-28851
Published: 2023-04-03
Description: Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowed for an attacker to perform a Cross-Site Scripting attack. The vulnerability was initially patched in version 1.0.2, and version 1.1.0 includes this patch. The bug was then accidentally re-introduced during a merge error, and has been re-patched in versions 2.2.5 and 3.1.1. There are no known workarounds for this vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/bigfork/silverstripe-form-capture/commit/5b3aa39dd1eef042f173167b0fa4d3f717971772; https://github.com/bigfork/silverstripe-form-capture/security/advisories/GHSA-38h6-gmr2-j4wx; https://github.com/bigfork/silverstripe-form-capture/commit/5b3aa39dd1eef042f173167b0fa4d3f717971772
CVE: CVE-2023-28854
Published: 2023-04-03
Description: nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made available at commit e5409aa2d441789cbb35f6b119bef97ecc3986aa on 2023-03-30. Users should update index.php to 2023-03-30 or later or, as a workaround, add a function such as `env_patchsample230330.php` to env.php.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aa; https://github.com/paijp/nophp/releases/tag/v0.0.1; https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwm
CVE: CVE-2022-3960
Published: 2023-04-03
Description: 
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin. 


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-96, CWE-94
References: https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]917--Resolved-Pentaho-BA-Server-Improper-Neutralization-of-Directives-in-Statically-Saved-Code-Static-Code-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-CVE-2022-3960-; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]917--Resolved-Pentaho-BA-Server-Improper-Neutralization-of-Directives-in-Statically-Saved-Code-Static-Code-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-CVE-2022-3960-
CVE: CVE-2022-43771
Published: 2023-04-03
Description: 
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds.  


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]509--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Limitation-of-a-Pathname-to-a-Restricted-Directory-Path-Traversal-Versions-before-9-4-0-0-and-9-3-0-1-including-8-3-x-Impacted-CVE-2022-43771-; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]509--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Limitation-of-a-Pathname-to-a-Restricted-Directory-Path-Traversal-Versions-before-9-4-0-0-and-9-3-0-1-including-8-3-x-Impacted-CVE-2022-43771-
CVE: CVE-2022-43772
Published: 2023-04-03
Description: 
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs. 


CVSS Score: 3.8 (LOW)
CWE: CWE-532, CWE-532
References: https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]045--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Insertion-of-Sensitive-Information-into-Log-File-Versions-before-9-4-0-0-and-9-3-0-1-including-8-3-x-Impacted-CVE-2022-43772-; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]045--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Insertion-of-Sensitive-Information-into-Log-File-Versions-before-9-4-0-0-and-9-3-0-1-including-8-3-x-Impacted-CVE-2022-43772-
CVE: CVE-2022-43938
Published: 2023-04-03
Description: 
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager. 


CVSS Score: 8.8 (HIGH)
CWE: CWE-96, CWE-94
References: https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]645--Resolved-Pentaho-BA-Server-Improper-Neutralization-of-Directives-in-Statically-Saved-Code-Static-Code-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43938-; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]645--Resolved-Pentaho-BA-Server-Improper-Neutralization-of-Directives-in-Statically-Saved-Code-Static-Code-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43938-
CVE: CVE-2022-43939
Published: 2023-04-03
Description: Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
CVSS Score: 8.6 (HIGH)
CWE: CWE-647
References: http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]333--Resolved-Pentaho-BA-Server-Use-of-Non-Canonical-URL-Paths-for-Authorization-Decisions-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43939-; http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html
CVE: CVE-2022-43940
Published: 2023-04-03
Description: 
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the data source management service. 


CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]973--Resolved-Pentaho-BA-Server-Incorrect-Authorization-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]973--Resolved-Pentaho-BA-Server-Incorrect-Authorization-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-
CVE: CVE-2022-43941
Published: 2023-04-03
Description: 
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference. 


CVSS Score: 7.1 (HIGH)
CWE: CWE-611, CWE-611
References: https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]957--Resolved-Pentaho-BA-Server-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-CVE-2022-43941-; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]957--Resolved-Pentaho-BA-Server-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-CVE-2022-43941-