TI-2025-00646 Aliases CVE-2025-0758 GHSA-mfp7-fc9g-2pqp

Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource

LOW 26CWE-732Published 2025-04-16 · Updated 2025-04-17

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Overview The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732) Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, is installed with Karaf JMX beans enabled and accessible by default. Impact When the vulnerability is leveraged, a user with local execution privileges can access functionality exposed by Karaf beans contained in the product.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0015 4th percentileScored 2026-11-07

Fix Fixed Pentaho Business Analytics Server (Hitachi Vantara): 10.2.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Hitachi Vantara	Pentaho Business Analytics Server	1.0 and later; 10.0 to before 10.2.0.2	10.2.0.2	Patch available	CNA

Pentaho Business Analytics Server VendorHitachi Vantara Affected 1.0 and later; 10.0 to before 10.2.0.2 Fixed in 10.2.0.2 Patch available CNA

Remediation

Fix · CNA Pentaho Business Analytics Server (Hitachi Vantara) Fixed in 10.2.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-04-16
Hitachi Vantara Pentaho Business Analytics Server 10.2.0.2
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2025-18613 Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity ReferencePriority LOW 23
- TI-2025-18612 Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity ReferencePriority LOW 23
- TI-2025-18611 Cross-site scripting in Hitachi Vantara Pentaho Business Analytics ServerPriority LOW 20
Show all 5 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-0758
2026-10-03 Alias added: GHSA-mfp7-fc9g-2pqp

References

Other 1

https://support.pentaho.com/hc/en-us/articles/35781318194061--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Incorrect-Permission-Assignment-for-Critical-Resource-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0758

TI-2022-21586 Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions KEVCVSS 3.1CRITICAL 9.8
TI-2022-21503 Injection in Hitachi Vantara Pentaho Business Analytics Server KEVCVSS 3.1HIGH 8.8
TI-2022-21585 Code injection in Hitachi Vantara Pentaho Business Analytics Server CVSS 3.1HIGH 8.8
TI-2022-21507 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource CVSS 3.1HIGH 8.8
TI-2022-21505 Path traversal in Hitachi Vantara Pentaho Business Analytics Server CVSS 3.1MEDIUM 6.5
TI-2026-74511 Default certificate key in Remot Ops Agent lets attackers bypass login CVSS 4.0CRITICAL 9.1

See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences