High severity · published Nov 2, 2022
CVE-2021-45447
Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear text
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and
8.3.0.25 with the Data Lineage feature enabled transmits database passwords in clear text.
The transmission of sensitive data in clear text allows unauthorized actors with access to the
network to sniff and obtain sensitive information that can be later used to gain unauthorized
access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PB
Pentaho Business Analytics Server · Hitachi Vantara
9.0.0.0 before 9.2.0.2; 1.0 before 8.3.0.25 · source: vendor
VP
Vantara Pentaho · Hitachi
8.3.0.0 before 8.3.0.25; 9.2.0.0 before 9.2.0.2 · source: NVD
Affected product
PB
Pentaho Business Analytics Server
Hitachi Vantara
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-45447
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-45447
Vendor Advisory
https://support.pentaho.com/hc/en-us/articles/6744504393101
More from Pentaho Business Analytics Server
9.8
CVE-2022-43939
Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions
7.2
CVE-2022-43769
Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
7.5
CVE-2021-45446
Pentaho Business Analytics Server - Exposure of Information Through Directory Listing
6.5
CVE-2021-45448
Pentaho Business Analytics Server - Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user supplied path to access resources that are out of bounds.