PT-2023-8804 · Hitachi Vantara · Hitachi Vantara Pentaho Business Analytics Server

Published 2023-09-26 · Updated 2023-09-29 · CVE-2023-2358

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:N/AC:L/Au:M/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.5.0.0 Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.3.0.4 Hitachi Vantara Pentaho Business Analytics Server version 8.3.x.x

Description The issue is related to the storage of passwords in a recoverable format. This allows a remote attacker to potentially disclose protected information. The passwords of the Hadoop Copy Files step are saved in plaintext.

Recommendations For versions prior to 9.5.0.0, update to version 9.5.0.0 or later. For versions prior to 9.3.0.4, update to version 9.3.0.4 or later. For version 8.3.x.x, update to a version outside of the 8.3.x.x range, such as version 9.3.0.4 or later. As a temporary workaround, consider restricting access to the Hadoop Copy Files step until a patch is available.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

CWE-257

Related Identifiers

BDU:2024-01959

CVE-2023-2358

Affected Products

Hitachi Vantara Pentaho Business Analytics Server

References · 6

• https://support.pentaho.com/hc/en-us/articles/19668208622221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2358 · Security Note
• https://bdu.fstec.ru/vul/2024-01959 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2358 · Vendor Advisory
• https://twitter.com/CVEnew/status/1706789089822068862 · Twitter Post
• https://twitter.com/DMFezzaReedCISA/status/1707071217524429271 · Twitter Post