Support Expiration Notice: Pentaho 9.3 will reach end of support on July 1, 2026. See this article for details.

Customer Portal

Get a grip on your data

With battle-tested solutions and a focus on foundational strength,

Pentaho helps you meet the challenges of an AI-driven world.

  1. Pentaho Customer Portal
  2. Known Vulnerability Updates
  3. Security Updates

(Resolved) Hitachi Vantara Pentaho Data Integration & Analytics - Missing Authorization - Versions before 10.2.0.6 impacted (CVE-2025-11158)

by Dan Begey - Follow

Overview 

The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862)

 

Products Affected 

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x

 

Description 

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.

 

Impact 

An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information, which can lead to remote code execution by unauthorized users.

 

Action  

We recommend you upgrade to the latest Hitachi Vantara Pentaho Data Integration & Analytics release or Service Pack where this vulnerability is addressed.

If using Pentaho Data Integration & Analytics 10.2, upgrade to 10.2.0.6 or later.

This issue is also resolved in Pentaho Data Integration & Analytics 11.0.

 

Internal Notes: (Non Customer View-able - Non Confidential)
 
This issue is logged under JIRA PPP-5778 
 

Comments