{"id":"CVE-2024-37362","aliases":["EUVD-2025-4638","GHSA-r5c8-8xvg-qm37"],"status":"published","title":"Hitachi Vantara Pentaho Data Integration \u0026 Analytics - Insufficiently Protected Credentials","description":"The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (CWE-522) \n\n\n\n \n\n\n\nHitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when saving connections to RedShift.\n\n\n\n \n\n\n\nProducts must not disclose sensitive information without cause. Disclosure of sensitive information can lead to further exploitation.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00285,"percentile":0.21279,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-522"],"published":"2025-02-19T23:34:29Z","modified":"2026-06-17T07:38:13Z","products":[{"vendor":"hitachi vantara","product":"pentaho business analytics server"},{"vendor":"hitachi vantara","product":"pentaho data integration \u0026 analytics"}],"references":[{"url":"https://support.pentaho.com/hc/en-us/articles/34296552220941--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Insufficiently-Protected-Credentials-Versions-before-10-2-0-0-and-9-3-0-8-including-8-3-x-Impacted-CVE-2024-37362"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37362"},{"url":"https://github.com/advisories/GHSA-r5c8-8xvg-qm37"}],"sources":{"cve":[{"id":"CVE-2024-37362","title":"Hitachi Vantara Pentaho Data Integration \u0026 Analytics - Insufficiently Protected Credentials","description":"The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (CWE-522) \n\n\n\n \n\n\n\nHitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when saving connections to RedShift.\n\n\n\n \n\n\n\nProducts must not disclose sensitive information without cause. Disclosure of sensitive information can lead to further exploitation.","status":"published","published":"2025-02-19T23:34:29.558Z","modified":"2025-02-20T17:23:41.44Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:34:00.585327Z"}],"euvd":[{"id":"EUVD-2025-4638","description":"The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (CWE-522) \n\n\n\n \n\n\n\nHitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when saving connections to RedShift.\n\n\n\n \n\n\n\nProducts must not disclose sensitive information without cause. Disclosure of sensitive information can lead to further exploitation.","status":"published","published":"2025-02-19T23:34:29Z","modified":"2025-02-20T17:23:41Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:53:26.353093Z"}],"ghsa":[{"id":"GHSA-r5c8-8xvg-qm37","title":"The product transmits or stores authentication credentials, but it uses an insecure method that...","description":"The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (CWE-522) \n\n\n\n \n\n\n\nHitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when saving connections to RedShift.\n\n\n\n \n\n\n\nProducts must not disclose sensitive information without cause. Disclosure of sensitive information can lead to further exploitation.","status":"published","published":"2025-02-20T00:32:05Z","modified":"2025-02-20T00:32:11Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:59:59.716099Z"}],"nvd":[{"id":"CVE-2024-37362","description":"The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (CWE-522) \n\n\n\n \n\n\n\nHitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when saving connections to RedShift.\n\n\n\n \n\n\n\nProducts must not disclose sensitive information without cause. Disclosure of sensitive information can lead to further exploitation.","status":"published","published":"2025-02-20T00:15:19.63Z","modified":"2026-06-17T07:38:13.447Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:10:44.508862Z"}]}}