CVE-2025-11158: falha crítica em Hitachi Vantara Pentaho Data Integration and…
Hitachi Vantara Pentaho Data Integration & Analytics - Missing Authorization
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.4%
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Hitachi Vantara · Pentaho Data Integration and AnalyticsCVEs relacionadas — Hitachi Vantara Pentaho Data Integration and…
No mesmo produto, das mais perigosas para as menos.
CVE-2025-9121HIGHHitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted DataEPSS 0.4%CVE-2025-11159CRITICALHitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party ComponentEPSS 0.3%CVE-2025-9122MEDIUMHitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive InformationEPSS 0.3%CVE-2026-2253HIGHHitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity ReferenceEPSS 0.2%CVE-2026-2255MEDIUMHitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected CredentialsEPSS 0.2%CVE-2026-2254MEDIUMHitachi Vantara Pentaho Data Integration & Analytics - Incorrect Permission Assignment for Critical ResourceEPSS 0.2%