Overview 

The product transmits or stores authentication credentials, but it uses an insecure method that is
susceptible to unauthorized interception and/or retrieval. (CWE-257)

 

Products Affected 

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including
8.3.x.x are impacted

 

Description 

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including
8.3.x.x, saves passwords of the Hadoop Copy Files step in plaintext.

 

Impact 

The storage of passwords in a recoverable format makes them subject to password reuse attacks by
malicious users. If a system administrator can recover a password directly, or use a brute force search
on the available information, the administrator can use the password on other accounts.

 

Action  

We recommend you upgrade to the latest Hitachi Vantara Pentaho version 9.5 release or above. For version 9.3 we recommend updating to Service Packs 9.3.0.4 or above where this vulnerability is addressed. 

Please review the Pentaho End-of-Life policy to ensure you are up to date.

 

---