Customer Portal

Get a grip on your data

With battle-tested solutions and a focus on foundational strength,

Pentaho+ helps you meet the challenges of an AI-driven world.

  1. Pentaho Customer Portal
  2. Known Vulnerability Updates
  3. Security Updates

(Resolved) Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges - Versions before 10.2.0.0 and 9.3.0.9, including 8.3.x Impacted (CVE-2024-6697)

by Brittany Owens - Follow

Overview 

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280)

 

Products Affected 

Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x

 

Description 

Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service.

 

Impact 

An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact.

 

Action  

We recommend you upgrade to the latest Hitachi Vantara Pentaho version 10.2 release. For version 9.3 we recommend updating to Service Packs 9.3.0.9 or above where this vulnerability is addressed.

Please review the Pentaho End-of-Life policy to ensure you are up to date.

 

Internal Notes: (Non Customer View-able - Non Confidential)

This issue is logged under JIRA PPP-5105

Comments