CVE-2021-34685
UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify...
UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upload various files of different file types. Specifically, a .jsp file is not allowed, but a .jsp. file is allowed (and leads to remote code execution).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upload various files of different file types. Specifically, a .jsp file is not allowed, but a .jsp. file is allowed (and leads to remote code execution).
- Record
CVE-2021-34685- CVSS 3.1
- 2.7 Low
CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:H/S:U/UI:N - Updated
- 2026-11-02
EUVDEUVD-2021-21335
UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upload various files of different file types. Specifically, a .jsp file is not allowed, but a .jsp. file is allowed (and leads to remote code execution).
- Record
EUVD-2021-21335- CVSS 3.1
- 2.7 Low
CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:H/S:U/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v548-fhp9-qm3wNo score
UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify...
UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upload various files of different file types. Specifically, a .jsp file is not allowed, but a .jsp. file is allowed (and leads to remote code execution).
- Record
GHSA-v548-fhp9-qm3w- Weakness
- CWE-434
- Updated
- 2026-11-02
NVD
UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upload various files of different file types. Specifically, a .jsp file is not allowed, but a .jsp. file is allowed (and leads to remote code execution).
- Record
CVE-2021-34685- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-434
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-34685 is a low vulnerability (CVSS 2.7) in Hitachi Vantara Pentaho, published November 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.32%, the 83rd percentile. No source names a fixed version.