Data Access XMLParserFactoryProducer Vulnerability in Hitachi Vantara Pentaho Business Analytics Server

CVE-2025-24911

Summary

Certain versions of Hitachi Vantara's Pentaho Business Analytics Server are vulnerable due to improper handling of XML External Entity (XXE) references. This vulnerability allows an attacker to craft XML content that can instruct the application to read files from the local filesystem when processed. Furthermore, attackers could exploit URIs with different schemes to force the application to make outbound requests to potentially malicious servers. Such exploitation can facilitate attacks while evading security measures like firewalls. It highlights a significant risk of unauthorized data exposure for organizations relying on this software.

References