CVE-2024-6696
Hitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access Control
- State
- Published
- Severity
- 4.9 Medium
- Published
- Feb 19, 2025
- Updated
- Feb 20, 2025
- Reserved
- Jul 11, 2024
Description
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. (CWE-1220)
Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not correctly perform an authorization check in the user console trash content
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | HITVAN |
Weaknesses
- CWE-1220 Insufficient Granularity of Access Control
Affected Products
| Product | Versions |
|---|---|
Pentaho Data Integration & AnalyticsHitachi Vantara |
|
Pentaho Business Analytics ServerHitachi Vantara |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.