CVE-2021-34685 File upload in n/a
An authenticated user can upload malicious JSP files to Hitachi Vantara Pentaho Business Analytics, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-34685?
CVE-2021-34685 is a low-severity vulnerability in n/a, published on 8 Nov 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upload various files of different file types. Specifically, a .jsp file is not allowed, but a .jsp. file is allowed (and leads to remote code execution).
Weakness: CWE-434
Which versions are affected by CVE-2021-34685?
It affects 1 product.
Products include Hitachi Vantara Pentaho.
How do I fix CVE-2021-34685?
No fix has been published for CVE-2021-34685 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-34685 being exploited?
There is no known exploitation of CVE-2021-34685 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-34684 SQL injection in n/a
- CVE-2021-31599 Code injection in n/a
- CVE-2022-4815 Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data
- CVE-2021-45447 Information disclosure in Pentaho Business Analytics Server
- CVE-2021-45448 Path traversal in Pentaho Business Analytics Server
Sources
Also known as GHSA-v548-fhp9-qm3w.