title: Hitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File
description:
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs.
problem types: CWE-532 Insertion of Sensitive Information into Log File
affected:
{
defaultStatus: unaffected
modules: Big Data Plugin
product: Pentaho Business Analytics Server
vendor: Hitachi Vantara
versions:
lessThan: 9.3.0.1, status: affected, version: 1.0, versionType: maven
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL