CVE-2024-6696: hitachi vantara pentaho business analytics server

Vulnerability summary

CVE-2024-6696 is a medium (CVSS 4.9) vulnerability in hitachi vantara pentaho business analytics server. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.2% of scored vulnerabilities.

Timeline

1. 19-02-2025
   PublishedVulnerability first disclosed.
2. 20-02-2025
   Last modifiedVulnerability information updated.

Description

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. (CWE-1220) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not correctly perform an authorization check in the user console trash content  An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network.

• CWE-1220Insufficient Granularity of Access ControlThe product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.