Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and 8.3.0.25 with the Data Lineage feature enabled transmits database passwords in clear text.   The transmissi...

CVE-2021-45447 · published 4 years ago
Summary


Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and
8.3.0.25 with the Data Lineage feature enabled transmits database passwords in clear text.  

The transmission of sensitive data in clear text allows unauthorized actors with access to the
network to sniff and ...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hitachi vantara_pentaho >= 8.3.0.0, < 8.3.0.25
>= 9.2.0.0, < 9.2.0.2
cpe:2.3:a:hitachi:vantara_pentaho:*:*:*:*:*:*:*:*
Original advisory text
Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and 8.3.0.25 with the Data Lineage feature enabled transmits database passwords in clear text.   The transmissi...

Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and
8.3.0.25 with the Data Lineage feature enabled transmits database passwords in clear text.  

The transmission of sensitive data in clear text allows unauthorized actors with access to the
network to sniff and obtain sensitive information that can be later used to gain unauthorized
access.


References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-319Cleartext Transmission of Sensitive Information
Timeline
Published2 Nov 2022
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2021-45447 · NVD
Track software like this
Free during beta