Read the docs
TI-2022-16743 Aliases CVE-2022-36407GHSA-rx84-4w3q-488h

Information Exposure Vulnerability in Hitachi Disk Array Systems

Priority MEDIUM 43CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

Insertion of Sensitive Information into Log File vulnerability in Hitachi Virtual Storage Platform, Hitachi Virtual Storage Platform VP9500, Hitachi Virtual Storage Platform G1000, G1500, Hitachi Virtual Storage Platform F1500, Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, Hitachi Virtual Storage Platform 5200, 5600, 5200H, 5600H, Hitachi Unified Storage VM, Hitachi Virtual Storage Platform G100, G200, G400, G600, G800, Hitachi Virtual Storage Platform F400, F600, F800, Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, Hitachi Virtual Storage Platform F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H allows local users to gain sensitive information.This issue affects Hitachi Virtual Storage Platform: before DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00; Hitachi Virtual Storage Platform VP9500: before DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00; Hitachi Virtual Storage Platform G1000, G1500: before DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00; Hitachi Virtual Storage Platform F1500: before DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00; Hitachi Virtual Storage Platform 5100, 5500,5100H, 5500H: before DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00, before DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00, before DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00; Hitachi Virtual Storage Platform 5200, 5600,5200H, 5600H: before DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00, before DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00, before DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00; Hitachi Unified Storage VM: before DKCMAIN Ver. 73-03-75-X0/00, SVP Ver. 73-03-74/00, before DKCMAIN Ver. 73(75)-03-75-X0/00, SVP Ver. 73(75)-03-74/00; Hitachi Virtual Storage Platform G100, G200, G400, G600, G800: before DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00, before DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00; Hitachi Virtual Storage Platform F400, F600, F800: before DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00, before DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00; Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900: before DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02; Hitachi Virtual Storage Platform F350, F370, F700, F900: before DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02; Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H: before DKCMAIN Ver. 93-06-81-X0/00, SVP Ver. 93-06-81-X0/00, before DKCMAIN Ver. 93-06-62-X0/00, SVP Ver. 93-06-62-X0/00, before DKCMAIN Ver. 93-06-43-X0/00, SVP Ver. 93-06-43-X0/00.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00514 44th percentileScored 2026-11-07
Fix Fixed Hitachi Virtual Storage Platform (Hitachi): DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00Hitachi Virtual Storage Platform VP9500 (Hitachi): DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00+10 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HitachiHitachi Virtual Storage Platformbefore DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00Patch availableCNA
HitachiHitachi Virtual Storage Platform VP9500before DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00Patch availableCNA
HitachiHitachi Virtual Storage Platform G1000, G1500before DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00Patch availableCNA
HitachiHitachi Virtual Storage Platform F1500before DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00Patch availableCNA
HitachiHitachi Virtual Storage Platform 5100, 5500, 5100H, 5500Hbefore DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00; before DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00; before DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00, DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00, DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00Patch availableCNA
HitachiHitachi Virtual Storage Platform 5200, 5600, 5200H, 5600Hbefore DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00; before DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00; before DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00, DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00, DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00Patch availableCNA
HitachiHitachi Unified Storage VMbefore DKCMAIN Ver. 73-03-75-X0/00, SVP Ver. 73-03-74/00; before DKCMAIN Ver. 73(75)-03-75-X0/00, SVP Ver. 73(75)-03-74/00DKCMAIN Ver. 73-03-75-X0/00, SVP Ver. 73-03-74/00, DKCMAIN Ver. 73(75)-03-75-X0/00, SVP Ver. 73(75)-03-74/00Patch availableCNA
HitachiHitachi Virtual Storage Platform G100, G200, G400, G600, G800before DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00; before DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00, DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00Patch availableCNA
HitachiHitachi Virtual Storage Platform F400, F600, F800before DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00; before DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00, DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00Patch availableCNA
HitachiHitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900before DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02Patch availableCNA
HitachiHitachi Virtual Storage Platform F350, F370, F700, F900before DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02Patch availableCNA
HitachiHitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090Hbefore DKCMAIN Ver. 93-06-81-X0/00, SVP Ver. 93-06-81-X0/00; before DKCMAIN Ver. 93-06-62-X0/00, SVP Ver. 93-06-62-X0/00; before DKCMAIN Ver. 93-06-43-X0/00, SVP Ver. 93-06-43-X0/00DKCMAIN Ver. 93-06-81-X0/00, SVP Ver. 93-06-81-X0/00, DKCMAIN Ver. 93-06-62-X0/00, SVP Ver. 93-06-62-X0/00, DKCMAIN Ver. 93-06-43-X0/00, SVP Ver. 93-06-43-X0/00Patch availableCNA
  • Hitachi Virtual Storage Platform VendorHitachi Affected before DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00 Fixed in DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00 Patch available CNA
  • Hitachi Virtual Storage Platform VP9500 VendorHitachi Affected before DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00 Fixed in DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00 Patch available CNA
  • Hitachi Virtual Storage Platform G1000, G1500 VendorHitachi Affected before DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00 Fixed in DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00 Patch available CNA
  • Hitachi Virtual Storage Platform F1500 VendorHitachi Affected before DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00 Fixed in DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00 Patch available CNA
  • Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H VendorHitachi Affected before DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00; before DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00; before DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00 Fixed in DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00, DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00, DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00 Patch available CNA
  • Hitachi Virtual Storage Platform 5200, 5600, 5200H, 5600H VendorHitachi Affected before DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00; before DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00; before DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00 Fixed in DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00, DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00, DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00 Patch available CNA
  • Hitachi Unified Storage VM VendorHitachi Affected before DKCMAIN Ver. 73-03-75-X0/00, SVP Ver. 73-03-74/00; before DKCMAIN Ver. 73(75)-03-75-X0/00, SVP Ver. 73(75)-03-74/00 Fixed in DKCMAIN Ver. 73-03-75-X0/00, SVP Ver. 73-03-74/00, DKCMAIN Ver. 73(75)-03-75-X0/00, SVP Ver. 73(75)-03-74/00 Patch available CNA
  • Hitachi Virtual Storage Platform G100, G200, G400, G600, G800 VendorHitachi Affected before DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00; before DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00 Fixed in DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00, DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00 Patch available CNA
  • Hitachi Virtual Storage Platform F400, F600, F800 VendorHitachi Affected before DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00; before DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00 Fixed in DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00, DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00 Patch available CNA
  • Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900 VendorHitachi Affected before DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02 Fixed in DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02 Patch available CNA
  • Hitachi Virtual Storage Platform F350, F370, F700, F900 VendorHitachi Affected before DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02 Fixed in DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02 Patch available CNA
  • Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H VendorHitachi Affected before DKCMAIN Ver. 93-06-81-X0/00, SVP Ver. 93-06-81-X0/00; before DKCMAIN Ver. 93-06-62-X0/00, SVP Ver. 93-06-62-X0/00; before DKCMAIN Ver. 93-06-43-X0/00, SVP Ver. 93-06-43-X0/00 Fixed in DKCMAIN Ver. 93-06-81-X0/00, SVP Ver. 93-06-81-X0/00, DKCMAIN Ver. 93-06-62-X0/00, SVP Ver. 93-06-62-X0/00, DKCMAIN Ver. 93-06-43-X0/00, SVP Ver. 93-06-43-X0/00 Patch available CNA

Remediation

  • Fix · CNA Hitachi Virtual Storage Platform (Hitachi) Fixed in DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00
  • Fix · CNA Hitachi Virtual Storage Platform VP9500 (Hitachi) Fixed in DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00
  • Fix · CNA Hitachi Virtual Storage Platform G1000, G1500 (Hitachi) Fixed in DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00
  • Fix · CNA Hitachi Virtual Storage Platform F1500 (Hitachi) Fixed in DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00
  • Fix · CNA Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H (Hitachi) Fixed in DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00, DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00, DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00
  • Fix · CNA Hitachi Virtual Storage Platform 5200, 5600, 5200H, 5600H (Hitachi) Fixed in DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00, DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00, DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00
  • Fix · CNA Hitachi Unified Storage VM (Hitachi) Fixed in DKCMAIN Ver. 73-03-75-X0/00, SVP Ver. 73-03-74/00, DKCMAIN Ver. 73(75)-03-75-X0/00, SVP Ver. 73(75)-03-74/00
  • Fix · CNA Hitachi Virtual Storage Platform G100, G200, G400, G600, G800 (Hitachi) Fixed in DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00, DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00
  • Fix · CNA Hitachi Virtual Storage Platform F400, F600, F800 (Hitachi) Fixed in DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00, DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00
  • Fix · CNA Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900 (Hitachi) Fixed in DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02
  • Fix · CNA Hitachi Virtual Storage Platform F350, F370, F700, F900 (Hitachi) Fixed in DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02
  • Fix · CNA Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H (Hitachi) Fixed in DKCMAIN Ver. 93-06-81-X0/00, SVP Ver. 93-06-81-X0/00, DKCMAIN Ver. 93-06-62-X0/00, SVP Ver. 93-06-62-X0/00, DKCMAIN Ver. 93-06-43-X0/00, SVP Ver. 93-06-43-X0/00

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36407
  2. 2026-10-03 Alias added: GHSA-rx84-4w3q-488h

References

Advisory 1

  • TI-2022-21586 Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-21503 Injection in Hitachi Vantara Pentaho Business Analytics Server KEVCVSS 3.1HIGH 8.8
  • TI-2021-11702 An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business… CVSS 3.1HIGH 7.5
  • TI-2005-00319 Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with… CVSS 2.0MEDIUM 5.0
  • TI-2022-21585 Code injection in Hitachi Vantara Pentaho Business Analytics Server CVSS 3.1HIGH 8.8
  • TI-2022-21507 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource CVSS 3.1HIGH 8.8
See all 256 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences