CVE-2022-4770

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.4.0.0 and 9.3.0.2, including 8.3.x

Description The issue is related to the error handling mechanism in Hitachi Vantara Pentaho Business Analytics Server, which displays the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt). This can allow a remote attacker to gain unauthorized access to protected information.

Recommendations For versions prior to 9.4.0.0, update to version 9.4.0.0 or later. For versions prior to 9.3.0.2, update to version 9.3.0.2 or later. As a temporary workaround, consider restricting access to Pentaho Reports (*.prpt) to minimize the risk of exploitation.