PT-2025-16911 · Hitachi Vantara · Pentaho Business Analytics Server+1

Published 2025-04-16 · Updated 2025-04-17 · CVE-2025-0757

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.2, including 9.3.x and 8.3.x

Description The software does not properly neutralize user-controllable input before it is placed in output that is used as a web page, allowing a malicious URL to inject content into the Analyzer plugin interface. This can lead to malicious activities, such as transferring private information, including cookies with session information, from the victim's machine to the attacker. The attacker can also send malicious requests to a website on behalf of the victim, potentially exploiting administrator privileges.

Recommendations For versions prior to 10.2.0.2, including 9.3.x and 8.3.x, update to version 10.2.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Analyzer plugin interface until a patch is available. Avoid using malicious or untrusted URLs in the Analyzer plugin interface to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-0757

Affected Products

Analyzer

Pentaho Business Analytics Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-0757 · Security Note
• https://t.me/cvedetector/23200 · Telegram Post
• https://support.pentaho.com/hc/en-us/articles/35781038882445--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Neutralization-of-Input-During-Web-Page-Generation-Cross-site-Scripting-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0757 · Note
• https://t.me/cvetracker/21816 · Telegram Post
• https://twitter.com/CVEnew/status/1912722262135865847 · Twitter Post