CVE-2024-28982CWE-776

Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference

High · published June 26, 2024

CVSS v3.1
7.1
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of the Pentaho User Console against XML External Entity Reference.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00379 · 30.7th percentile
Weakness
CWE-776 · Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Published
2024-06-26T22:37Z
EPSS history
Timeline
  • 26 JUN 22:37Z
    Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference
    cvelistv5