Overview 

The product transmits or stores authentication credentials, but it uses an insecure method that is
susceptible to unauthorized interception and/or retrieval. (CWE-257)

Products Affected 

Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4

Description 

Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4 save passwords of the Hadoop Copy Files step in plaintext.

Impact 

The storage of passwords in a recoverable format makes them subject to password reuse attacks by
malicious users. If a system administrator can recover a password directly, or use a brute force search
on the available information, the administrator can use the password on other accounts.

Action  

We recommend you upgrade to the latest Pentaho version 9.5 release or newer. For version 9.3 we recommend updating to Service Packs 9.3.0.4 or above where this vulnerability is addressed. 

Please review the Pentaho End-of-Life policy to ensure you are up to date.