PT-2023-2231 · Hitachi Vantara · Pentaho Business Analytics Server

Published 2023-04-03 · Updated 2023-04-10 · CVE-2022-43772

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.4.0.0 Hitachi Vantara Pentaho Business Analytics Server version 9.3.0.1 and earlier Hitachi Vantara Pentaho Business Analytics Server version 8.3.x with the Big Data Plugin

Description The issue is related to the exposure of sensitive information through log files, allowing a remote attacker to gain unauthorized access to protected information. Specifically, the username and password of clusters are exposed in clear text into system logs.

Recommendations For versions prior to 9.4.0.0, update to version 9.4.0.0 or later. For version 9.3.0.1 and earlier, update to version 9.3.0.1 or later, or apply the recommended fix for version 9.3. For version 8.3.x with the Big Data Plugin, remove or disable the Big Data Plugin until a patch is available. As a temporary workaround, consider restricting access to system logs to minimize the risk of exploitation.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2023-01985

CVE-2022-43772

Affected Products

Pentaho Business Analytics Server

References · 5

• https://support.pentaho.com/hc/en-us/articles/14454594588045--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Insertion-of-Sensitive-Information-into-Log-File-Versions-before-9-4-0-0-and-9-3-0-1-including-8-3-x-Impacted-CVE-2022-43772- · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43772 · Security Note
• https://bdu.fstec.ru/vul/2023-01985 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43772 · Vendor Advisory
• https://t.me/cibsecurity/61347 · Telegram Post