Hitachi Vantara Pentaho BA Platform CVE-2016-10701 Cross Site Request Forgery Vulnerability

Bugtraq ID:	102200
Class:	Input Validation Error
CVE:	CVE-2016-10701
Remote:	Yes
Local:	No
Published:	Nov 27 2017 12:00AM
Updated:	Dec 19 2017 09:01PM
Credit:	Vendor has reported this issue.
Vulnerable:	HitachiVantara Pentaho 8.0
Not Vulnerable:

Hitachi Vantara Pentaho BA Platform CVE-2016-10701 Cross Site Request Forgery Vulnerability

Hitachi Vantara Pentaho BA Platform is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

Hitachi Vantara Pentaho BA Platform CVE-2016-10701 Cross Site Request Forgery Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Hitachi Vantara Pentaho BA Platform CVE-2016-10701 Cross Site Request Forgery Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Hitachi Vantara Pentaho BA Platform CVE-2016-10701 Cross Site Request Forgery Vulnerability

References:

• pentaho home page (pentaho)
  
• As a system admin, I want the pentaho server to run with Tomcat 7. (pentaho)
  
• CSRF Protection Built into Pentaho Application (pentaho)
  
• Upgrade to Tomcat 7, and incorporate the CSRF prevention filter (pentaho)