CVE-2024-6697 - CVE House
Back to Database
Status published Medium CVE-2024-6697

Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges

Vulnerability Description

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280)   Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service.   An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-6697

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Hitachi Group Member

References

More from Hitachi Vantara

View All →
CVE-2025-9122
Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information
Medium 5.3
CVE-2025-9121
Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data
High 8.8
CVE-2025-24911
Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference
Medium 4.9
CVE-2025-24910
Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference
Medium 4.9
CVE-2025-24909
Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Medium 4.4

Affected Vendor

Hitachi Vantara

View all reports →

Affected Software

Pentaho Data Integration & Analytics, Pentaho Business Analytics Server
Vulnerable Versions:
10.0, 1.0

Timeline

Official Publish: February 19th, 2025
Last Modified: February 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-280

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.