title:  Pentaho Business Analytics Server - Exposure of Information Through Directory Listing
description: A vulnerability in
Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and
8.3.0.25 does not cascade the hidden property to the children of the Home folder.  This directory listing provides an attacker with the complete index of all the resources located
inside the directory.
problem types: CWE-548
affected:
{
defaultStatus: unaffected
product: Pentaho Business Analytics Server
vendor: Hitachi Vantara
versions:
lessThan: 8.3.0.25, status: affected, version: 1.0, versionType: ALL
lessThan: 9.2.0.2, status: affected, version: 9.0, versionType: ALL
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL