PT-2025-16912 · Apache+1 · Karaf+1

Published 2025-04-16 · Updated 2025-04-17 · CVE-2025-0758

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.2 Hitachi Vantara Pentaho Business Analytics Server versions 9.3.x Hitachi Vantara Pentaho Business Analytics Server versions 8.3.x

Description The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. When the issue is leveraged, a user with local execution privileges can access functionality exposed by Karaf beans contained in the product.

Recommendations For versions prior to 10.2.0.2, update to version 10.2.0.2 or later to resolve the issue. For versions 9.3.x, update to version 10.2.0.2 or later to resolve the issue. For versions 8.3.x, update to version 10.2.0.2 or later to resolve the issue. As a temporary workaround, consider disabling the Karaf JMX beans to minimize the risk of exploitation.

Fix

LPE

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2025-0758

Affected Products

Hitachi Vantara Pentaho Business Analytics Server

Karaf

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-0758 · Security Note
• https://t.me/cvedetector/23195 · Telegram Post
• https://twitter.com/CVEnew/status/1912722263041847627 · Twitter Post
• https://support.pentaho.com/hc/en-us/articles/35781318194061--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Incorrect-Permission-Assignment-for-Critical-Resource-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0758 · Note
• https://t.me/cvetracker/21817 · Telegram Post