Vulnerability in Hitachi Vantara Pentaho Business Analytics Server
CVE-2024-6697
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service. An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact.
EPSS: 0.003 (23.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Hitachi Vantara Pentaho Business Analytics Server — versions 1.0
- Hitachi Vantara Pentaho Data Integration & Analytics — versions 10.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-6697?
- CVE-2024-6697 is a medium-severity vulnerability in Hitachi Vantara Pentaho Business Analytics Server, classified under Improper Handling of Insufficient Permissions or Privileges. CVSS score: 6.5/10. Published 2025-02-20.
- How severe is CVE-2024-6697?
- Medium severity. CVSS v3 base score is 6.5 out of 10.