Hitachi Vantara Pentaho Business Analytics Server XML External Entity Injection Vulnerability

A vulnerability exists in Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.2, including 9.3.x and 8.3.x. The issue arises because the application does not properly safeguard the Pentaho Data Integration MessageSourceCrawler against out-of-band XML External Entity references. This flaw allows an attacker to exploit the XML parsing process by defining an external entity that points to a local file or an external server, potentially leading to unauthorized file access or manipulation of outgoing requests.

Impact

Exploitation of this vulnerability allows for unauthorized reading of local files or manipulation of outgoing requests to external servers, which could be used to bypass firewall restrictions or obscure the source of certain attacks, such as port scanning.