CVE-2021-28052: hitach vantara
Vulnerability summary
CVE-2021-28052 is a high (CVSS 7.5) vulnerability in hitach vantara. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 55.2% of scored vulnerabilities.
Timeline
- 26-09-2022PublishedVulnerability first disclosed.
- 21-05-2025Last modifiedVulnerability information updated.
Description
A tenant administrator Hitachi Content Platform (HCP) may modify the configuration in another tenant without authorization, potentially allowing unauthorized access to data in the other tenant. Also, a tenant user (non-administrator) may view configuration in another tenant without authorization. This issue affects: Hitachi Vantara Hitachi Content Platform versions prior to 8.3.7; 9.0.0 versions prior to 9.2.3.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.77%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
+0.08 pp
From 0.70% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Hitach1 product
- vantara< 8.3.7 | ≥ 9.0.0, < 9.2.3
Hitachi vantara1 product
- hitachi content platform≥ unspecified, < 8.3.7 | ≥ 9.0.0, < 9.2.3
2 vendors · 2 products