CVE-2024-6697 json
Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges
published 2025-02-19 20 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-4636
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 26%
- public exploits
- 0
- none known
Summary
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280)
Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service.
An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact.
Patch / fix
- Hitachi Vantara Pentaho Data Integration & Analytics 10.2.0.0
- Hitachi Vantara Pentaho Business Analytics Server 9.3.0.9
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Hitachi Vantara Pentaho Data Integration & Analytics
- Hitachi Vantara Pentaho Business Analytics Server
Classification
- Weakness
-
- CWE-280 Improper Handling of Insufficient Permissions or Privileges
References
Sources
- CVE List CVE-2024-6697
- NVD CVE-2024-6697
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.