CVE-2021-45447

published 2022-11-02

CVE-2021-45447: Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and 8.3.0.25 with the Data Lineage feature enabled transmits database…

Priority P3 41 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and
8.3.0.25 with the Data Lineage feature enabled transmits database passwords in clear text.

The transmission of sensitive data in clear text allows unauthorized actors with access to the
network to sniff and obtain sensitive information that can be later used to gain unauthorized
access.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
hitachi	vantara_pentaho	>= 8.3.0.0 < 8.3.0.25	8.3.0.25
hitachi	vantara_pentaho	>= 9.2.0.0 < 9.2.0.2	9.2.0.2
hitachi_vantara	pentaho_business_analytics_server	>= 1.0 < 8.3.0.25	8.3.0.25
hitachi_vantara	pentaho_business_analytics_server	>= 9.0.0.0 < 9.2.0.2	9.2.0.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-319