Pentaho Server Vulnerable to XML External Entity Reference Attack

CVE-2024-28982

Summary

The vulnerability affects the Hitachi Vantara Pentaho Business Analytics Server, where an improper restriction of the ACL service endpoint enables potential exploitation through XML External Entity (XXE) reference. This flaw arises in versions prior to 10.1.0.0, 9.3.0.7, and 8.3.x, exposing users and systems to the risk of unauthorized access or data leakage. Proper security measures and updates should be implemented to mitigate this vulnerability.

References