CVE-2021-31599

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho versions through 9.1 Pentaho Business Intelligence Server versions through 7.x

Description An issue allows the inclusion of BeanShell scripts in reports (.prpt) files to ease the production of complex reports. An authenticated user can run arbitrary code.

Recommendations For Hitachi Vantara Pentaho versions through 9.1, consider restricting the ability to include BeanShell scripts in reports to minimize the risk of exploitation. For Pentaho Business Intelligence Server versions through 7.x, consider disabling the feature that allows the inclusion of BeanShell scripts in reports until a fix is available. As a temporary workaround, consider limiting access to reports that include BeanShell scripts to only necessary personnel.