CVE-2025-24907: fallo de gravedad media en Hitachi Vantara Pentaho Data Integration &…
Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.8epss 0.4%
Overview
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)
Description
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the CGG Draw API.
Impact
This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Productos afectados
Hitachi Vantara · Pentaho Data Integration & AnalyticsCVEs relacionadas — Hitachi Vantara Pentaho Data Integration &…
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-0756CRITICALHitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')EPSS 1.0%CVE-2024-5706HIGHHitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')EPSS 0.7%CVE-2023-3517HIGHHitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')EPSS 0.6%CVE-2024-37361CRITICALHitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted DataEPSS 0.5%CVE-2024-37359HIGHHitachi Vantara Pentaho Business Analytics Server – Server Side Request ForgeryEPSS 0.5%CVE-2025-24908MEDIUMHitachi Vantara Pentaho Data Integration & Analytics – Path TraversalEPSS 0.5%