Hitachi Vantara Pentaho Business Analytics Server - generates an error message that includes sensitive information about its environment, users, or associated data. (CWE-209)
Hitachi Vantara Pentaho Business Analytics Server versions before 220.127.116.11 and 18.104.22.168, including 8.3.x are impacted.
Hitachi Vantara Pentaho Business Analytics Server prior to versions 22.214.171.124 and 126.96.36.199, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt).
An attacker may use the contents of error messages to help launch another, more focused attack. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.
We recommend you upgrade to the latest Hitachi Vantara Pentaho version 9.4 release. For version 9.3 we recommend updating to Service Packs 188.8.131.52 or above where this vulnerability is addressed.
Please review the Pentaho End-of-Life policy to ensure you are up to date.
This issue is logged under JIRA PPP-4765