title: Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information
description:
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt).
problem types: CWE-209 Generation of Error Message Containing Sensitive Information
affected:
{
defaultStatus: unaffected
product: Pentaho Business Analytics Server
vendor: Hitachi Vantara
versions:
lessThan: 9.3.0.2, status: affected, version: 1.0, versionType: maven
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL