CVE-2021-28052 - CVE House

Back to Database

Status published High CVE-2021-28052

Hitachi Content Platform Information Disclosure Vulnerability

7.5 CVSS

Vulnerability Description

A tenant administrator Hitachi Content Platform (HCP) may modify the configuration in another tenant without authorization, potentially allowing unauthorized access to data in the other tenant. Also, a tenant user (non-administrator) may view configuration in another tenant without authorization. This issue affects: Hitachi Vantara Hitachi Content Platform versions prior to 8.3.7; 9.0.0 versions prior to 9.2.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-28052

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Hitachi Vantara

View All →

Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information

Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data

Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference

Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference

Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Vendor

Hitachi Vantara

View all reports →

Affected Software

Hitachi Content Platform

Vulnerable Versions:

unspecified, 9.0.0

Timeline

Official Publish: September 26th, 2022

Last Modified: May 21st, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1087 Account Discovery

T1485 Data Destruction