CVE-2021-31599

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. A reports (.prpt) file allows the inclusion of BeanShell scripts to ease the production of complex reports. An authenticated user can run arbitrary code.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Nov 8, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-31609.8Deserialization of untrusted data in the login page of ASSUWEB 359.3 build 1 subcomponent of ACA ASSUREX RENTES product allows a remote attaCVE-2021-316004.3An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a seriesCVE-2021-316016.5An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a seriesCVE-2021-316027.5An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The Security Model has CVE-2021-316046.5furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client.CVE-2021-316057.5furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket. This can shut down the servCVE-2021-316067.5furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients.CVE-2021-316077.8In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escaCVE-2021-316084.3Proofpoint Enterprise Protection before 18.8.0 allows a Bypass of a Security Control.CVE-2021-316096.5The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP packCVE-2021-316106.5The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, alloCVE-2021-316115.7The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle an out-of-order LMP Setup procedure
CVE-2021-31599: High severity, CVSS 8.8 | Vulnix