CVE-2024-28981

HIGH EPSS 18.6%

Published Sep 12, 20241y ago · Modified Jun 17, 20262w ago

8.5 CVSS 3.1

High

Published Sep 12, 2024 1y ago

Last Modified Jun 17, 2026 2w ago

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when searching metadata injectable fields.

CVSS Details

Base Score

8.5

Exploitability

3.1

Impact

4.7

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Changed

Confidentiality High

Integrity Low

Availability None

Threat Intelligence

EPSS Exploit Probability

18.6% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-522

References 1

support.pentaho.com https://support.pentaho.com/hc/en-us/articles/27569056997261--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Insufficiently-Protected-Credentials-Versions-before-10-1-0-0-including-9-3-x-and-8-3-x-impacted-CVE-2024-28981

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.