Out-of-band XML External Entity Reference Vulnerability in Hitachi Vantara Pentaho Business Analytics Server

CVE-2025-24910

What is CVE-2025-24910?

The Hitachi Vantara Pentaho Business Analytics Server prior to version 10.2.0.2, including versions 9.3.x and 8.3.x, is vulnerable to an out-of-band XML External Entity Reference. This vulnerability allows attackers to craft XML files that define external entities, which, when processed by the server, can lead to unintentional disclosure of local file contents or the ability to initiate requests to external servers. Such actions can enable attackers to bypass security measures, facilitating unauthorized access to sensitive information and avenues for further attacks.

References