Medium severity · published Sep 26, 2023
CVE-2023-2358
Hitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable Format
4.9
CVSS
0.3%
EPSS
No
On KEV
Description
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in plaintext.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PB
Pentaho Business Analytics Server · Hitachi Vantara
1.0 before 9.3.0.5; 9.5.0.0 before 9.5.0.1 · source: vendor
PB
Pentaho Business Analytics · Hitachivantara
before 9.3.0.5; 8.3.0.0 · source: NVD
Affected product
PB
Pentaho Business Analytics Server
Hitachi Vantara
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2358
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2358
Vendor Advisory
https://support.pentaho.com/hc/en-us/articles/19668208622221
More from Pentaho Business Analytics Server
9.8
CVE-2022-43939
Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions
7.2
CVE-2022-43769
Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
9.9
CVE-2024-37361
Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data
8.8
CVE-2024-5705
Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization
8.8
CVE-2024-5706
Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')