Hitachi Vantara
Monthly
An authenticated administrator on Hitachi Vantara can retrieve password reset codes for arbitrary users through a privileged API, enabling takeover of other accounts on the application. This CWE-640 weakness is rated 7.4 High by CVSS 4.0 and requires high privileges (PR:H per the CVSS vector), so exploitation is confined to malicious insiders or attackers who already possess administrator access; device credentials and customer data remain inaccessible per the vendor. No public exploit identified at time of analysis.
Unauthenticated remote attackers can mint valid JWT access tokens - and thereby log in as an administrator - on affected Hitachi Vantara deployments by abusing the private key shipped inside the product's default self-signed SSL certificate (CWE-321, hard-coded cryptographic key). Exploitation is gated by a single configuration precondition: the web interface must still be running the out-of-the-box default certificate whose key material is reused to sign session JWTs, which is why the vendor's CVSS 4.0 vector carries AT:P (attack requirements present) even though no authentication or user interaction is needed (PR:N/UI:N). Impact is bounded to administrative/configuration control such as changing service settings or requesting log collection - the vendor states device credentials and customer data are not reachable - and no public exploit was identified at time of analysis (the issue is not in CISA KEV).
External XML entity resolution in Hitachi Vantara Pentaho Data Integration & Analytics lets an authenticated, low-privileged attacker submit crafted XML that the application's parser resolves, disclosing sensitive local files and enabling server-side request forgery against internal systems. All releases before 10.2.0.7 are affected, as are 11.x branches before 11.0.0.0, explicitly including the 9.3.x and 8.3.x lines. There is no public exploit identified at time of analysis, and the EPSS exploitation probability is very low (0.03%, 8th percentile).
Plaintext credential exposure in Hitachi Vantara Pentaho Data Integration & Analytics allows authenticated network users to retrieve Hadoop cluster credentials via the Cluster Test API response. Affected versions span the 8.3.x, 9.3.x, and 10.x lines up to 10.2.0.6, as well as all pre-11.0.0.0 builds in the 11.x line. The vendor acknowledges partial self-mitigation: because the Cluster Test API is only accessible to users who already hold sufficient privileges to submit Hadoop jobs via the backend API, the incremental credential exposure is constrained - though the plaintext disclosure still enables credential harvesting for lateral movement or offline use. No public exploit code exists and EPSS is negligible at time of analysis.
Missing ACL enforcement on Hitachi Vantara Pentaho Data Integration & Analytics API endpoints allows authenticated low-privileged users to interact with platform mail notification resources without authorization. Affected versions span the 8.3.x, 9.3.x, and pre-10.2.0.6/11.0.0.0 release lines. An attacker with a valid low-privilege account can read, modify, or disrupt mail notification configurations, resulting in limited confidentiality, integrity, and availability impact. No public exploit code exists and no active exploitation has been identified at time of analysis.
Script execution in Hitachi Vantara Pentaho Data Integration & Analytics allows an authenticated data-source administrator to execute arbitrary code via the bundled H2 JDBC driver when creating a new database connection. The product ships a vulnerable H2 driver that honors the INIT/RUNSCRIPT connection parameter, so a crafted JDBC URL causes an attacker-supplied SQL/script payload to run at connection time. All versions prior to 10.2.0.7 and 11.0.0.0 are affected; EPSS is 0.07% (20th percentile), CISA SSVC records no observed exploitation and no automatable path, and no public exploit code has been identified at time of analysis. The practical barrier is high - it requires PR:H (data-source administrator rights) - making this a privileged-feature-abuse or insider-threat vector rather than an unauthenticated remote attack. Vendor-released patch: 10.2.0.7 and 11.0.0.0.
An authenticated administrator on Hitachi Vantara can retrieve password reset codes for arbitrary users through a privileged API, enabling takeover of other accounts on the application. This CWE-640 weakness is rated 7.4 High by CVSS 4.0 and requires high privileges (PR:H per the CVSS vector), so exploitation is confined to malicious insiders or attackers who already possess administrator access; device credentials and customer data remain inaccessible per the vendor. No public exploit identified at time of analysis.
Unauthenticated remote attackers can mint valid JWT access tokens - and thereby log in as an administrator - on affected Hitachi Vantara deployments by abusing the private key shipped inside the product's default self-signed SSL certificate (CWE-321, hard-coded cryptographic key). Exploitation is gated by a single configuration precondition: the web interface must still be running the out-of-the-box default certificate whose key material is reused to sign session JWTs, which is why the vendor's CVSS 4.0 vector carries AT:P (attack requirements present) even though no authentication or user interaction is needed (PR:N/UI:N). Impact is bounded to administrative/configuration control such as changing service settings or requesting log collection - the vendor states device credentials and customer data are not reachable - and no public exploit was identified at time of analysis (the issue is not in CISA KEV).
External XML entity resolution in Hitachi Vantara Pentaho Data Integration & Analytics lets an authenticated, low-privileged attacker submit crafted XML that the application's parser resolves, disclosing sensitive local files and enabling server-side request forgery against internal systems. All releases before 10.2.0.7 are affected, as are 11.x branches before 11.0.0.0, explicitly including the 9.3.x and 8.3.x lines. There is no public exploit identified at time of analysis, and the EPSS exploitation probability is very low (0.03%, 8th percentile).
Plaintext credential exposure in Hitachi Vantara Pentaho Data Integration & Analytics allows authenticated network users to retrieve Hadoop cluster credentials via the Cluster Test API response. Affected versions span the 8.3.x, 9.3.x, and 10.x lines up to 10.2.0.6, as well as all pre-11.0.0.0 builds in the 11.x line. The vendor acknowledges partial self-mitigation: because the Cluster Test API is only accessible to users who already hold sufficient privileges to submit Hadoop jobs via the backend API, the incremental credential exposure is constrained - though the plaintext disclosure still enables credential harvesting for lateral movement or offline use. No public exploit code exists and EPSS is negligible at time of analysis.
Missing ACL enforcement on Hitachi Vantara Pentaho Data Integration & Analytics API endpoints allows authenticated low-privileged users to interact with platform mail notification resources without authorization. Affected versions span the 8.3.x, 9.3.x, and pre-10.2.0.6/11.0.0.0 release lines. An attacker with a valid low-privilege account can read, modify, or disrupt mail notification configurations, resulting in limited confidentiality, integrity, and availability impact. No public exploit code exists and no active exploitation has been identified at time of analysis.
Script execution in Hitachi Vantara Pentaho Data Integration & Analytics allows an authenticated data-source administrator to execute arbitrary code via the bundled H2 JDBC driver when creating a new database connection. The product ships a vulnerable H2 driver that honors the INIT/RUNSCRIPT connection parameter, so a crafted JDBC URL causes an attacker-supplied SQL/script payload to run at connection time. All versions prior to 10.2.0.7 and 11.0.0.0 are affected; EPSS is 0.07% (20th percentile), CISA SSVC records no observed exploitation and no automatable path, and no public exploit code has been identified at time of analysis. The practical barrier is high - it requires PR:H (data-source administrator rights) - making this a privileged-feature-abuse or insider-threat vector rather than an unauthenticated remote attack. Vendor-released patch: 10.2.0.7 and 11.0.0.0.