Riskcovery

CVE-2025-0758

Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource

State
Published
Severity
6.1 Medium
Published
Apr 16, 2025
Updated
Apr 17, 2025
Reserved
Jan 27, 2025

Read the record on cve.org

Description

Overview

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732)

Description

Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, is installed with Karaf JMX beans enabled and accessible by default.

Impact

When the vulnerability is leveraged, a user with local execution privileges can access functionality exposed by Karaf beans contained in the product.

Scores

CVSSScoreVectorSource
3.16.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:HHITVAN

Weaknesses

  • CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

ProductVersions
Pentaho Business Analytics ServerHitachi Vantara
  • 1.0 through 9.3.*Affected
  • 10.0 to before 10.2.0.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.