CVE-2024-28982

Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference

State: Published
Severity: 7.1 High
Published: Jun 26, 2024
Updated: Sep 11, 2024
Reserved: Mar 13, 2024

Description

Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of the Pentaho User Console against XML External Entity Reference.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H	HITVAN

Weaknesses

CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Affected Products

Product	Versions
Pentaho Business Analytics ServerHitachi Vantara	1.0 to before 9.3.0.7Affected 8.3 to before 10.1.0.0Affected

References

https://support.pentaho.com/hc/en-us/articles/27569195609869--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Restriction-of-XML-External-Entity-Reference-versions-before-10-1-0-0-and-9-3-0-7-including-8-3-x-Impacted-CVE-2024-28982

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.