{"id":"CVE-2022-43772","state":"PUBLISHED","title":"Hitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File","description":"\nHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs. \n\n","publishedAt":"2023-04-03T18:50:58.827Z","updatedAt":"2025-02-11T14:29:10.931Z","severity":{"score":3.8,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","source":"HITVAN"},"assigner":"HITVAN","products":["Hitachi Vantara  Pentaho Business Analytics Server"],"affected":[{"vendor":"Hitachi Vantara ","product":"Pentaho Business Analytics Server","defaultStatus":"unaffected","versions":[{"version":"1.0","status":"affected","lessThan":"9.3.0.1","versionType":"maven"}],"modules":["Big Data Plugin"]}],"references":["https://support.pentaho.com/hc/en-us/articles/14454594588045--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Insertion-of-Sensitive-Information-into-Log-File-Versions-before-9-4-0-0-and-9-3-0-1-including-8-3-x-Impacted-CVE-2022-43772-"],"weaknesses":["CWE-532"],"ingestedAt":"2026-10-29T19:50:43.581Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/43xxx/CVE-2022-43772.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-43772","state":"PUBLISHED","datePublished":"2023-04-03T18:50:58.827Z","dateUpdated":"2025-02-11T14:29:10.931Z","assignerShortName":"HITVAN","assignerOrgId":"dce6e192-ff49-4263-9134-f0beccb9bc13","dateReserved":"2022-10-26T12:55:14.327Z"},"containers":{"cna":{"title":"Hitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File     ","descriptions":[{"lang":"en","value":"\nHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs. \n\n"}],"affected":[{"vendor":"Hitachi Vantara ","product":"Pentaho Business Analytics Server","defaultStatus":"unaffected","versions":[{"version":"1.0","status":"affected","lessThan":"9.3.0.1","versionType":"maven"}],"modules":["Big Data Plugin"]}],"references":[{"url":"https://support.pentaho.com/hc/en-us/articles/14454594588045--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Insertion-of-Sensitive-Information-into-Log-File-Versions-before-9-4-0-0-and-9-3-0-1-including-8-3-x-Impacted-CVE-2022-43772-"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-532","description":"CWE-532 Insertion of Sensitive Information into Log File","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"HITVAN","orgId":"dce6e192-ff49-4263-9134-f0beccb9bc13","dateUpdated":"2023-04-03T18:50:58.827Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Harry Withington, Aura Information Security"}],"impacts":[{"capecId":"CAPEC-37","descriptions":[{"lang":"en","value":"CAPEC-37 Retrieve Embedded Sensitive Data"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://support.pentaho.com/hc/en-us/articles/14454594588045--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Insertion-of-Sensitive-Information-into-Log-File-Versions-before-9-4-0-0-and-9-3-0-1-including-8-3-x-Impacted-CVE-2022-43772-","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T13:40:06.443Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-11T14:29:06.035853Z","id":"CVE-2022-43772","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-11T14:29:10.931Z"}}]}}}