CVE-2023-5617 - OpenCVE

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a server error is encountered.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://support.pentaho.com/hc/en-us/articles/24313358254861--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Server-generated-Error-Message-Containing-Sensitive-Information-Versions-before-10-1-0-0-and-9-3-0-6-including-all-versions-before-10-0-x-Impacted-CVE-2023-5617

History

No history.

MITRE

Status: PUBLISHED

Assigner: HITVAN

Published: 2024-02-28T22:30:40.128Z

Updated: 2024-08-29T14:47:10.616Z

Reserved: 2023-10-17T15:42:11.661Z

Link: CVE-2023-5617

Vulnrichment

Updated: 2024-08-02T08:07:32.308Z

NVD

Status : Awaiting Analysis

Published: 2024-02-28T23:15:08.260

Modified: 2024-02-29T13:49:47.277

Link: CVE-2023-5617

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-5617", "assignerOrgId": "dce6e192-ff49-4263-9134-f0beccb9bc13", "state": "PUBLISHED", "assignerShortName": "HITVAN", "dateReserved": "2023-10-17T15:42:11.661Z", "datePublished": "2024-02-28T22:30:40.128Z", "dateUpdated": "2024-08-29T14:47:10.616Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Pentaho Data Integration & Analytics", "vendor": "Hitachi Vantara", "versions": [{"lessThan": "9.3.0.6", "status": "affected", "version": "1.0", "versionType": "maven"}, {"lessThan": "10.1.0.0", "status": "affected", "version": "9.4.0.0", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Hitachi Group Member"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<p>Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including <span style=\"background-color: var(--wht);\">9.5.x and 8.3.x, display the version of Tomcat when a server error is encountered.</span></p>\n\n"}], "value": "\nHitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including\u00a09.5.x and 8.3.x, display the version of Tomcat when a server error is encountered.\n\n\n\n"}], "impacts": [{"capecId": "CAPEC-170", "descriptions": [{"lang": "en", "value": "CAPEC-170 Web Application Fingerprinting"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-550", "description": "CWE-550: Server-generated Error Message Containing Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "dce6e192-ff49-4263-9134-f0beccb9bc13", "shortName": "HITVAN", "dateUpdated": "2024-02-28T22:30:40.128Z"}, "references": [{"url": "https://support.pentaho.com/hc/en-us/articles/24313358254861--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Server-generated-Error-Message-Containing-Sensitive-Information-Versions-before-10-1-0-0-and-9-3-0-6-including-all-versions-before-10-0-x-Impacted-CVE-2023-5617"}], "source": {"discovery": "INTERNAL"}, "title": "Hitachi Vantara Pentaho Data Integration & Analytics - Server-generated Error Message Containing Sensitive Information", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:07:32.308Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.pentaho.com/hc/en-us/articles/24313358254861--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Server-generated-Error-Message-Containing-Sensitive-Information-Versions-before-10-1-0-0-and-9-3-0-6-including-all-versions-before-10-0-x-Impacted-CVE-2023-5617", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "hitachi_vantara", "product": "pentaho_data_integration_\\&_analytics", "cpes": ["cpe:2.3:a:hitachi_vantara:pentaho_data_integration_\\&_analytics:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.0", "status": "affected", "lessThan": "9.3.0.6", "versionType": "custom"}, {"version": "9.4.0.0", "status": "affected", "lessThan": "10.1.0.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-05T18:28:22.655674Z", "id": "CVE-2023-5617", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-29T14:47:10.616Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.pentaho.com/hc/en-us/articles/24313358254861--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Server-generated-Error-Message-Containing-Sensitive-Information-Versions-before-10-1-0-0-and-9-3-0-6-including-all-versions-before-10-0-x-Impacted-CVE-2023-5617", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:07:32.308Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-5617", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-05T18:28:22.655674Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:hitachi_vantara:pentaho_data_integration_\\&_analytics:*:*:*:*:*:*:*:*"], "vendor": "hitachi_vantara", "product": "pentaho_data_integration_\\&_analytics", "versions": [{"status": "affected", "version": "1.0", "lessThan": "9.3.0.6", "versionType": "custom"}, {"status": "affected", "version": "9.4.0.0", "lessThan": "10.1.0.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-29T14:46:44.133Z"}}], "cna": {"title": "Hitachi Vantara Pentaho Data Integration & Analytics - Server-generated Error Message Containing Sensitive Information", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Hitachi Group Member"}], "impacts": [{"capecId": "CAPEC-170", "descriptions": [{"lang": "en", "value": "CAPEC-170 Web Application Fingerprinting"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hitachi Vantara", "product": "Pentaho Data Integration & Analytics", "versions": [{"status": "affected", "version": "1.0", "lessThan": "9.3.0.6", "versionType": "maven"}, {"status": "affected", "version": "9.4.0.0", "lessThan": "10.1.0.0", "versionType": "maven"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.pentaho.com/hc/en-us/articles/24313358254861--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Server-generated-Error-Message-Containing-Sensitive-Information-Versions-before-10-1-0-0-and-9-3-0-6-including-all-versions-before-10-0-x-Impacted-CVE-2023-5617"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nHitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including\u00a09.5.x and 8.3.x, display the version of Tomcat when a server error is encountered.\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<p>Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including <span style=\"background-color: var(--wht);\">9.5.x and 8.3.x, display the version of Tomcat when a server error is encountered.</span></p>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-550", "description": "CWE-550: Server-generated Error Message Containing Sensitive Information"}]}], "providerMetadata": {"orgId": "dce6e192-ff49-4263-9134-f0beccb9bc13", "shortName": "HITVAN", "dateUpdated": "2024-02-28T22:30:40.128Z"}}}, "cveMetadata": {"cveId": "CVE-2023-5617", "state": "PUBLISHED", "dateUpdated": "2024-08-29T14:47:10.616Z", "dateReserved": "2023-10-17T15:42:11.661Z", "assignerOrgId": "dce6e192-ff49-4263-9134-f0beccb9bc13", "datePublished": "2024-02-28T22:30:40.128Z", "assignerShortName": "HITVAN"}, "dataVersion": "5.1"}