Vulnerability · Published Feb 19, 2025 · Assigned by HITVAN
CVE-2024-6697Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges
Medium 6.5
In plain English
A medium-severity security flaw in Pentaho Business Analytics Server from Hitachi Vantara. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Official description
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service. An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hitachi Vantara | Pentaho Data Integration & Analytics | 10.0 – before 10.2.0.0 |
| Hitachi Vantara | Pentaho Business Analytics Server | 1.0 – before 9.3.0.9 |
Weakness: CWE-280 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H