Hitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File

CVE-2022-43772

3.8LOW

Key Information

Vendor: Hitachi
Status: Pentaho Business Analytics Server
Vendor: CVE Published:; 3 April 2023

Summary

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs.

Affected Version(s)

Pentaho Business Analytics Server < 9.3.0.1

CVSS V3.1

Score:

3.8

Severity:

LOW

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Unchanged

Timeline

Risk change from: 6.5 to: 3.8 - (LOW)
Aug 3, 2024
Vulnerability published.
Apr 3, 2023
Vulnerability Reserved.
Oct 26, 2022

Collectors

NVD DatabaseMitre Database

Credit

Harry Withington, Aura Information Security