High severity · published Nov 8, 2021
CVE-2021-31602
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x
7.5
CVSS
51.7%
EPSS
No
On KEV
Description
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the applicationContext-spring-security.xml file. The default configuration allows an unauthenticated user with no previous knowledge of the platform settings to extract pieces of information without possessing valid credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)51.7% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VP
Vantara Pentaho · Hitachi
through 9.1.0.0 · source: NVD
VP
Vantara Pentaho Business Intelligence Server · Hitachi
through 7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-31602
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-31602
Exploit
http://packetstormsecurity.com/files/164784/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Authentication-Bypass.html
Vendor Advisory
https://www.hitachi.com/hirt/security/index.html
More from Vantara Pentaho
9.8
CVE-2021-34684
Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data source and thus retrieve data from the…
8.8
CVE-2022-4815
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved…
8.8
CVE-2021-31599
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x
7.5
CVE-2021-45447
Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear text
7.5
CVE-2021-45446
Pentaho Business Analytics Server - Exposure of Information Through Directory Listing