CVE-2025-0758CWE-732

Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource

Medium · published April 16, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
3.8
In the wild
Unconfirmed
What it is

Overview

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732)

Description

Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, is installed with Karaf JMX beans enabled and accessible by default.

Impact

When the vulnerability is leveraged, a user with local execution privileges can access functionality exposed by Karaf beans contained in the product.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00150 · 3.8th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2025-04-16T22:12Z
EPSS history
Timeline
  • 16 APR 22:12Z
    Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource
    cvelistv5