CVE-2021-31602

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x

Medium · published November 8, 2021

Patch now

High probability of exploitation

CVSS calls it medium at 5.3. It sits in the 98.9th percentile for exploit probability.

CVSS v3.1
5.3
EPSS
52%
Percentile
98.9
In the wild
Unconfirmed
What it is

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the applicationContext-spring-security.xml file. The default configuration allows an unauthenticated user with no previous knowledge of the platform settings to extract pieces of information without possessing valid credentials.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.51653 · 98.9th percentile
Published
2021-11-08T03:30Z
EPSS history
Timeline
  • 08 NOV 03:30Z
    An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x
    cvelistv5