PT-2025-16914 · Hitachi Vantara · Hitachi Vantara Pentaho Data Integration & Analytics

Published 2025-04-16 · Updated 2025-04-17 · CVE-2025-24907

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 10.2.0.2, including 9.3.x and 8.3.x

Description The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.

Recommendations For versions prior to 10.2.0.2, including 9.3.x and 8.3.x, update to version 10.2.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the CGG Draw API to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-35

Related Identifiers

CVE-2025-24907

Affected Products

Hitachi Vantara Pentaho Data Integration & Analytics

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-24907 · Security Note
• https://twitter.com/CVEnew/status/1912722256230314480 · Twitter Post
• https://t.me/cvedetector/23187 · Telegram Post
• https://twitter.com/cybercronai/status/1912831096963662062 · Twitter Post
• https://t.me/cvetracker/21821 · Telegram Post
• https://support.pentaho.com/hc/en-us/articles/35781624069005--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Path-Traversal-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24907 · Note