Path Traversal Vulnerability in Hitachi Vantara Pentaho Data Integration & Analytics
CVE-2025-24907

6.8MEDIUM

Key Information:

Vendor
Hitachi
Status
Pentaho Data Integration & Analytics
Vendor
CVE Published:
16 April 2025

Summary

Hitachi Vantara Pentaho Data Integration & Analytics prior to version 10.2.0.2 has a vulnerability that allows an attacker to manipulate the file path used in the CGG Draw API. The application fails to adequately sanitize user input, specifically allowing sequences such as '.../...//', which can lead to unauthorized access to sensitive files or directories outside the intended restricted path.

Affected Version(s)

Pentaho Data Integration & Analytics 1.0 <= 9.3.*

Pentaho Data Integration & Analytics 10.0 < 10.2.0.2

References

https://support.pentaho.com/hc/en-us/articles/35781624069...

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

.