Vulnerability in Hitachi Vantara Pentaho Business Analytics Server
CVE-2024-6696
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. (CWE-1220) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not correctly perform an authorization check in the user console trash content An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (27.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 27.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Hitachi Vantara Pentaho Business Analytics Server — versions 1.0
- Hitachi Vantara Pentaho Data Integration & Analytics — versions 10.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-6696?
- CVE-2024-6696 is a medium-severity vulnerability in Hitachi Vantara Pentaho Business Analytics Server, classified under CWE-1220. CVSS score: 4.9/10. Published 2025-02-20.
- How severe is CVE-2024-6696?
- Medium severity. CVSS v3 base score is 4.9 out of 10.