CVE-2021-31601

Published: Nov 8, 2021Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all databases connection details and credentials.

Affected (2)

Products: Hitachi: Vantara Pentaho, Vantara Pentaho Business Intelligence Server

2 products

Vantara Pentaho

Vantara Pentaho Business Intelligence Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Hitachi Vantara Pentaho	Up to 9.1.0.0
Hitachi Vantara Pentaho Business Intelligence Server	Up to 7.1

References (4)

http://packetstormsecurity.com/files/164779/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Insufficient-Access-Control.html

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://www.hitachi.com/hirt/security/index.html

Source: cve@mitre.org

Vendor Advisory

http://packetstormsecurity.com/files/164779/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Insufficient-Access-Control.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://www.hitachi.com/hirt/security/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.