PT-2025-7411 · Hitachi Vantara+1 · Hitachi Vantara Pentaho Data Integration & Analytics+1

Published 2025-02-19 · Updated 2025-02-20 · CVE-2024-37362

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 10.2.0.0 and 9.3.0.8, including 8.3.x

Description The product transmits or stores authentication credentials using an insecure method, making it susceptible to unauthorized interception and/or retrieval. This issue can lead to the disclosure of sensitive information, such as database passwords, when saving connections to RedShift. Products should not disclose sensitive information without cause, as this can lead to further exploitation.

Recommendations For versions prior to 10.2.0.0, update to version 10.2.0.0 or later to resolve the issue. For versions prior to 9.3.0.8, update to version 9.3.0.8 or later to resolve the issue. For version 8.3.x, consider disabling the feature to save connections to RedShift until a patch is available, or update to a version that includes the fix, if available. At the moment, there is no information about other versions that contain a fix for this vulnerability.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2025-02155

CVE-2024-37362

Affected Products

Hitachi Vantara Pentaho Data Integration & Analytics

Redshift

References · 6

• https://bdu.fstec.ru/vul/2025-02155 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-37362 · Security Note
• https://twitter.com/CVEnew/status/1892361113188376786 · Twitter Post
• https://vuldb.com/?id.296317 · Note
• https://support.pentaho.com/hc/en-us/articles/34296552220941--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Insufficiently-Protected-Credentials-Versions-before-10-2-0-0-and-9-3-0-8-including-8-3-x-Impacted-CVE-2024-37362 · Note
• https://t.me/cvedetector/18489 · Telegram Post