What’s Vulnerable › Vulnerabilities
CVE-2025-9122: Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-15 · updated 2026-10-07
- Weakness: CWE-209
Description
Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full server stack trace when encountering an error within the GetCdfResource servlet.
Affected products
- Hitachi Vantara Pentaho Data Integration and Analytics: from 1.0 before 10.2.0.4 — fixed in 10.2.0.4
How to fix
Upgrade to a fixed version: Hitachi Vantara Pentaho Data Integration and Analytics 10.2.0.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-9122 or the next vulnerability affects your stack