CVE-2021-31602

nvd nist nuclei

Published: Nov 8, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the applicationContext-spring-security.xml file. The default configuration allows an unauthenticated user with no previous knowledge of the platform settings to extract pieces of information without possessing valid credentials.

Affected (2)

Products: Hitachi: Vantara Pentaho, Vantara Pentaho Business Intelligence Server

2 products

Vantara Pentaho

Vantara Pentaho Business Intelligence Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Hitachi Vantara Pentaho	Up to 9.1.0.0
Hitachi Vantara Pentaho Business Intelligence Server	Up to 7.1

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

http://packetstormsecurity.com/files/164784/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Authentication-Bypass.html

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://www.hitachi.com/hirt/security/index.html

Source: cve@mitre.org

Vendor Advisory

http://packetstormsecurity.com/files/164784/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Authentication-Bypass.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://www.hitachi.com/hirt/security/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.