{"id":"CVE-2021-45446","aliases":["EUVD-2021-32217","GHSA-jgwp-h4gx-xm93"],"status":"published","title":"Pentaho Business Analytics Server - Exposure of Information Through Directory Listing","description":"A vulnerability in \n\nHitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and \n8.3.0.25 does not cascade the hidden property to the children of the Home folder.  This directory listing provides an attacker with the complete index of all the resources located \ninside the directory.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00506,"percentile":0.43564,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-281","CWE-548","CWE-668"],"published":"2022-11-02T14:26:02Z","modified":"2026-06-17T04:13:23Z","products":[{"vendor":"hitachi","product":"vantara_pentaho"},{"vendor":"hitachi vantara","product":"pentaho business analytics server"}],"references":[{"url":"https://support.pentaho.com/hc/en-us/articles/6744813983501","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45446"},{"url":"https://github.com/advisories/GHSA-jgwp-h4gx-xm93"}],"sources":{"cve":[{"id":"CVE-2021-45446","title":" Pentaho Business Analytics Server - Exposure of Information Through Directory Listing","description":"A vulnerability in \n\nHitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and \n8.3.0.25 does not cascade the hidden property to the children of the Home folder.  This directory listing provides an attacker with the complete index of all the resources located \ninside the directory. \n\n\n","status":"published","published":"2022-11-02T14:26:02.105Z","modified":"2025-05-02T15:52:28.178Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-548"],"updated_at":"2026-11-02T14:33:02.580561Z"}],"euvd":[{"id":"EUVD-2021-32217","description":"A vulnerability in \n\nHitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and \n8.3.0.25 does not cascade the hidden property to the children of the Home folder.  This directory listing provides an attacker with the complete index of all the resources located \ninside the directory. \n\n\n","status":"published","published":"2022-11-02T14:26:02Z","modified":"2025-05-02T15:52:28Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:51:55.85045Z"}],"ghsa":[{"id":"GHSA-jgwp-h4gx-xm93","title":"A vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and...","description":"A vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 does not cascade the hidden property to the children of the Home folder. This directory listing provides an attacker with the complete index of all the resources located inside the directory.","status":"published","published":"2022-11-02T19:00:29Z","modified":"2023-07-21T18:30:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-281","CWE-548","CWE-668"],"updated_at":"2026-11-02T14:54:42.596364Z"}],"nvd":[{"id":"CVE-2021-45446","description":"A vulnerability in \n\nHitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and \n8.3.0.25 does not cascade the hidden property to the children of the Home folder.  This directory listing provides an attacker with the complete index of all the resources located \ninside the directory. \n\n\n","status":"published","published":"2022-11-02T15:15:09.683Z","modified":"2026-06-17T04:13:23.11Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-548","CWE-281"],"updated_at":"2026-11-02T14:07:06.906968Z"}]}}