CVE-2023-5617 Hitachi Vantara Pentaho Data Integration & Analytics - Server-generated Error Message Containing Sensitive Information
Attackers can obtain sensitive Tomcat version information from server error messages in Pentaho Data Integration, aiding further reconnaissance.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-5617?
CVE-2023-5617 is a medium-severity vulnerability in Hitachi Vantara Pentaho Data Integration & Analytics, published on 28 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a server error is encountered.
Which versions are affected by CVE-2023-5617?
It affects 1 product.
Products include Hitachi Vantara Pentaho Data Integration and Analytics.
How do I fix CVE-2023-5617?
No fix has been published for CVE-2023-5617 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-5617 being exploited?
There is no known exploitation of CVE-2023-5617 in the wild and no public exploit code.
Other vulnerabilities in Hitachi Vantara Pentaho Data Integration & Analytics
- CVE-2025-11159 Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component
- CVE-2025-11158 Hitachi Vantara Pentaho Data Integration & Analytics - Missing Authorization
- CVE-2026-2253 Hitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity Reference
- CVE-2026-2254 Hitachi Vantara Pentaho Data Integration & Analytics - Incorrect Permission Assignment for Critical Resource
- CVE-2026-2255 Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials
Sources
Also known as GHSA-69jc-r7p8-4cpg.