CVE-2021-31600: Hitachi Vantara Pentaho

Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days.

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all valid usernames.

Affected products

• Hitachi Vantara Pentaho: up to and including 9.1.0.0
• Hitachi Vantara Pentaho Business Intelligence Server: up to and including 7.1

Published 2021-11-08. Last modified 2026-06-17.