Yellowfin 7.35 with Security Vulnerability in Apache Tomcat.

Hello Manikandan,

Thanks for reaching out to Yellowfin Support.

To proceed further, could you kindly provide the following details:

1. Could you please share info.jsp. To access this page, just append info.jsp to your YF URL. E.g. http://localhost:8080/info.jsp

2. Could you please let me know if there is any specific CVE or CWE number that you are referring to? I looked at the image however it didn't helped.

3. If possible, could you please share the complete vulnerability scan report document for us to investigate further.

Regards,
Sharwari Inkane

Hi Sharwari,

I have requested the above details, we will update to soon.

Thanks.

Hello Manikandan,

Thanks for your response. Please keep me updated once you received the requested details.

Regards,
Sharwari Inkane

Hi Sharwari,

The user was unable to browse the http://localhost:8080/info.jsp so we requested them to export system information, please find details in the Word document.

Regarding the CVE number find the scan report in the Excel sheet. I reviewed the report for CVE number but it was not mentioned explicitly, When I searched on the internet I could find relatively the same in https://www.tenable.com/plugins/nessus/147163

Let me know if any more details are needed.

Thanks,

Manikandan

Hello Manikandan,

Thanks for sharing the system information and complete vulnerability scan report. Typically, vulnerabilities of this type are resolved by upgrading the Tomcat to the latest version 9.0.73. Could you kindly attempt to manually upgrade your Tomcat version to 9.0.73 and then rerun the report? Please verify if any vulnerabilities remain after the Tomcat upgrade. Please follow the instructions provided in the following article for Tomcat upgrade: https://community.yellowfinbi.com/knowledge-base/article/how-to-upgrade-tomcat

Please be aware that Yellowfin Version 7 is no longer supported, and we kindly request you to either download or upgrade to the latest version using this link provided. If you are upgrading from version 7.3 to version 9, it's important to follow the correct upgrade path. We recommend the following upgrade path: 7.3 -> 7.35 -> 8.0 -> 9.8 (or any 9.x version you prefer). It's also important to note that Yellowfin 9.9 comes with Tomcat 9.0.73. However, upgrading to Yellowfin version 9.9 will not automatically upgrade Tomcat; the new installation will include the updated version.

Regards,
Sharwari Inkane

Hello Manikandan,

I hope all is well,

I just want to touch base to see if you had a chance to read through my response. If you can let me know that would be great.

Regards,
Sharwari Inkane

Hi Sharwari,

I will update the status tomorrow, I have informed them about these details waiting for their input.

Thanks,

Manikandan

Hello Manikandan,

Thanks for your response. Please keep me updated once you received any input from user.

Regards,
Sharwari Inkane

Hello Manikandan,

I just wanted to check in and see if you have received any input from the user. Please let me know.
Thanks and have a great day!

Regards,
Sharwari Inkane

Hello Manikandan,

I hope all is well,

I just want to touch base to see if you had a chance to read through my response. If you can let me know that would be great.

Regards,
Sharwari Inkane

Yeah Sharwari, I have shared the details with them, but they are yet to come back.

I will you know the status as soon as inform us.

Regards,

Manikandan

Hello Manikandan,

Sure, Thanks for the update. I will await your response.

Regards,
Sharwari Inkane

Hi Sarwari,

Thanks for your support.

No further input is required, we provided the instructions to upgrade the Tomcat.

Regards,

Manikandan

Hello Manikandan,

Thanks for your response. I will now go ahead and mark this case as completed. Feel free to contact us with any questions or concerns; we would be more than happy to assist you.

Have a great rest of your day!

Thanks!

Regards,

Sharwari Inkane