Data Access XMLParserFactoryProducer Vulnerability in Hitachi Vantara Pentaho Business Analytics Server

CVE-2025-24911

What is CVE-2025-24911?

Certain versions of Hitachi Vantara's Pentaho Business Analytics Server are vulnerable due to improper handling of XML External Entity (XXE) references. This vulnerability allows an attacker to craft XML content that can instruct the application to read files from the local filesystem when processed. Furthermore, attackers could exploit URIs with different schemes to force the application to make outbound requests to potentially malicious servers. Such exploitation can facilitate attacks while evading security measures like firewalls. It highlights a significant risk of unauthorized data exposure for organizations relying on this software.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References