Medium severity · published Nov 8, 2021
CVE-2021-31601
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x
6.5
CVSS
1.4%
EPSS
No
On KEV
Description
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all databases connection details and credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VP
Vantara Pentaho · Hitachi
through 9.1.0.0 · source: NVD
VP
Vantara Pentaho Business Intelligence Server · Hitachi
through 7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-31601
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-31601
Exploit
http://packetstormsecurity.com/files/164779/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Insufficient-Access-Control.html
Vendor Advisory
https://www.hitachi.com/hirt/security/index.html
More from Vantara Pentaho
9.8
CVE-2021-34684
Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data source and thus retrieve data from the…
8.8
CVE-2022-4815
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved…
8.8
CVE-2021-31599
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x
7.5
CVE-2021-45447
Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear text
7.5
CVE-2021-45446
Pentaho Business Analytics Server - Exposure of Information Through Directory Listing