What’s Vulnerable › Vulnerabilities
CVE-2024-6697: Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-02-20 · updated 2026-06-17
- Weakness: CWE-280
Description
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service. An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact.
Affected products
- Hitachi Vantara Pentaho Data Integration & Analytics: from 10.0 before 10.2.0.0 — fixed in 10.2.0.0
- Hitachi Vantara Pentaho Business Analytics Server: from 1.0 before 9.3.0.9 — fixed in 9.3.0.9
How to fix
Upgrade to a fixed version: Hitachi Vantara Pentaho Data Integration & Analytics 10.2.0.0; Hitachi Vantara Pentaho Business Analytics Server 9.3.0.9. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-6697 or the next vulnerability affects your stack