PT-2025-7452 · Hitachi Vantara · Hitachi Vantara Pentaho Business Analytics Server

Published 2024-07-11 · Updated 2025-02-20 · CVE-2024-6697

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.0 and 9.3.0.9, including 8.3.x

Description The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact.

Recommendations For Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.0 and 9.3.0.9, including 8.3.x, update to version 10.2.0.0 or 9.3.0.9 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.

Fix

Weakness Enumeration

CWE-280

Related Identifiers

BDU:2025-02150

CVE-2024-6697

Affected Products

Hitachi Vantara Pentaho Business Analytics Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-6697 · Security Note
• https://bdu.fstec.ru/vul/2025-02150 · Security Note
• https://support.pentaho.com/hc/en-us/articles/34296654642701--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Handling-of-Insufficient-Permissions-or-Privileges-Versions-before-10-2-0-0-and-9-3-0-9-including-8-3-x-Impacted-CVE-2024-6697 · Note
• https://t.me/cvedetector/18486 · Telegram Post
• https://twitter.com/CVEnew/status/1892361114081767910 · Twitter Post
• https://vuldb.com/?id.296326 · Note