// For flags

CVE-2024-6697

Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service. An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact.

*Credits: Hitachi Group Member
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
None
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-07-11 CVE Reserved
  • 2025-02-19 CVE Published
  • 2025-02-20 CVE Updated
  • 2025-02-20 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-280: Improper Handling of Insufficient Permissions or Privileges
CAPEC
  • CAPEC-212: Functionality Misuse
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Hitachi Vantara
Search vendor "Hitachi Vantara"
 Pentaho Data Integration & Analytics
Search vendor "Hitachi Vantara" for product "Pentaho Data Integration & Analytics"
 >= 10.0.0.0 < 10.2.0.0
Search vendor "Hitachi Vantara" for product "Pentaho Data Integration & Analytics" and version " >= 10.0.0.0 < 10.2.0.0"
en
Affected
Hitachi Vantara
Search vendor "Hitachi Vantara"
 Pentaho Business Analytics Server
Search vendor "Hitachi Vantara" for product "Pentaho Business Analytics Server"
 >= 1.0.0.0 < 9.3.0.9
Search vendor "Hitachi Vantara" for product "Pentaho Business Analytics Server" and version " >= 1.0.0.0 < 9.3.0.9"
en
Affected