Unauthorized Access Vulnerability in Hitachi Vantara Pentaho Business Analytics Server
CVE-2025-0758

6.1MEDIUM

Key Information:

Vendor
Hitachi
Status
Pentaho Business Analytics Server
Vendor
CVE Published:
16 April 2025

Summary

The Hitachi Vantara Pentaho Business Analytics Server is susceptible to a vulnerability that inadequately restricts permissions for critical resources. This flaw permits unauthorized users with local execution privileges to access and manipulate functionality exposed via Karaf JMX beans. By default, these beans are enabled, posing a significant risk to the integrity and confidentiality of the system, as they can be exploited by unintended actors.

Affected Version(s)

Pentaho Business Analytics Server 1.0 <= 9.3.*

Pentaho Business Analytics Server 10.0 < 10.2.0.2

References

https://support.pentaho.com/hc/en-us/articles/35781318194...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.