« Volver al listado

CVE-2025-24909

Estado: AplazadaMedia (4.4)—

Overview

The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79)

Description

Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface.

Impact

Once the malicious script is injected, the attacker can perform a variety of malicious activities.

Leer descripción completaMostrar menos

The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Hitachivantara — Pentaho Business Analytics ServerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-24909",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-24909",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-17T13:29:52.868850Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security.vulnerabilities@hitachivantara.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.7
      }
    ]
  },
  "affected": [
    {
      "source": "security.vulnerabilities@hitachivantara.com",
      "affectedData": [
        {
          "vendor": "Hitachi Vantara",
          "product": "Pentaho Business Analytics Server",
          "versions": [
            {
              "status": "affected",
              "version": "1.0",
              "versionType": "maven",
              "lessThanOrEqual": "9.3.*"
            },
            {
              "status": "affected",
              "version": "10.0",
              "lessThan": "10.2.0.2",
              "versionType": "maven"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-16T23:15:45.263",
  "references": [
    {
      "url": "https://support.pentaho.com/hc/en-us/articles/35782541484045--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Neutralization-of-Input-During-Web-Page-Generation-Cross-site-Scripting-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24909",
      "source": "security.vulnerabilities@hitachivantara.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security.vulnerabilities@hitachivantara.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Overview \n\n\n\n \n\n\n\nThe software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79) \n\n\n\n \n\n\n\nDescription \n\n\n\n \n\n\n\nHitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface. \n\n\n\n \n\n\n\nImpact \n\n\n\n \n\n\n\nOnce the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site."
    },
    {
      "lang": "es",
      "value": "Descripción general: El software no neutraliza o neutraliza incorrectamente la entrada controlable por el usuario antes de que se coloque en la salida que se usa como una página web que se sirve a otros usuarios. (CWE-79) Descripción: Hitachi Vantara Pentaho Business Analytics Server anteriores a las versiones 10.2.0.2, incluidas 9.3.x y 8.3.x, permiten que una URL maliciosa inyecte contenido en la interfaz del complemento Analyzer. Impacto Una vez que se inyecta el script malicioso, el atacante puede realizar una variedad de actividades maliciosas. El atacante podría transferir información privada, como cookies que pueden incluir información de sesión, desde la máquina de la víctima al atacante. El atacante podría enviar solicitudes maliciosas a un sitio web en nombre de la víctima, lo que podría ser especialmente peligroso para el sitio si la víctima tiene privilegios de administrador para administrar ese sitio."
    }
  ],
  "lastModified": "2026-06-17T08:59:49.693",
  "sourceIdentifier": "security.vulnerabilities@hitachivantara.com"
}