Pentaho Server Vulnerable to XML External Entity Reference Attack
CVE-2024-28982

8.2HIGH

Key Information:

Vendor

Hitachi Vantara

Status
Pentaho Business Analytics Server
Vendor
CVE Published:
26 June 2024

What is CVE-2024-28982?

The vulnerability affects the Hitachi Vantara Pentaho Business Analytics Server, where an improper restriction of the ACL service endpoint enables potential exploitation through XML External Entity (XXE) reference. This flaw arises in versions prior to 10.1.0.0, 9.3.0.7, and 8.3.x, exposing users and systems to the risk of unauthorized access or data leakage. Proper security measures and updates should be implemented to mitigate this vulnerability.

References

https://support.pentaho.com/hc/en-us/articles/27569195609...

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.