PT-2024-2658 · Hitachi Vantara+1 · Hitachi Vantara Pentaho Data Integration & Analytics+1
Published
2024-02-28
·
Updated
2025-02-14
·
CVE-2023-5617
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x
Description
The issue is related to the disclosure of information through a server error message. It may allow a remote attacker to disclose protected information. When a server error is encountered, the version of Tomcat is displayed.
Recommendations
For versions prior to 10.1.0.0, update to version 10.1.0.0 or later to resolve the issue.
For version 9.3.0.6, ensure that the version of Tomcat is not disclosed when a server error is encountered, consider disabling error messages or restricting access to error pages until a patch is available.
For versions 9.5.x and 8.3.x, update to a version that does not display the Tomcat version when a server error is encountered, or consider implementing measures to prevent information disclosure, such as custom error pages.
Fix
Generation of Error Message Containing Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Hitachi Vantara Pentaho Data Integration & Analytics
Apache Tomcat