PT-2025-16913 · Hitachi Vantara · Hitachi Vantara Pentaho Data Integration & Analytics

Published 2025-04-16 · Updated 2025-04-18 · CVE-2025-0756

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 10.2.0.2

Description The product receives input from an upstream component but does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. This could allow an attacker to gain access to or modify sensitive data or system resources, potentially leading to remote code execution by unauthorized users.

Recommendations For versions prior to 10.2.0.2, update to version 10.2.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to JNDI identifiers during the creation of platform data sources to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-99

Related Identifiers

CVE-2025-0756

Affected Products

Hitachi Vantara Pentaho Data Integration & Analytics

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-0756 · Security Note
• https://t.me/cvetracker/21815 · Telegram Post
• https://t.me/cvedetector/23199 · Telegram Post
• https://twitter.com/CveFindCom/status/1912634868829204935 · Twitter Post
• https://twitter.com/CVEnew/status/1912722261229895733 · Twitter Post
• https://twitter.com/threatsbank/status/1913126275478172029 · Twitter Post
• https://https//support.pentaho.com/hc/en-us/articles/35771876077709--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Improper-Control-of-Resource-Identifiers-Resource-Injection-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0756 · Note
• https://twitter.com/cybercronai/status/1912831096963662062 · Twitter Post