{"id":"CVE-2024-6697","state":"PUBLISHED","title":"Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges","description":"The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280)\n\n\n\n \n\n\n\nHitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service.\n\n\n\n \n\n\n\nAn adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact.","publishedAt":"2025-02-19T23:32:18.713Z","updatedAt":"2025-02-20T17:23:54.281Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"HITVAN"},"assigner":"HITVAN","products":["Hitachi Vantara Pentaho Data Integration & Analytics","Hitachi Vantara Pentaho Business Analytics Server"],"affected":[{"vendor":"Hitachi Vantara","product":"Pentaho Data Integration & Analytics","defaultStatus":"unaffected","versions":[{"version":"10.0","status":"affected","lessThan":"10.2.0.0","versionType":"maven"}]},{"vendor":"Hitachi Vantara","product":"Pentaho Business Analytics Server","defaultStatus":"unaffected","versions":[{"version":"1.0","status":"affected","lessThan":"9.3.0.9","versionType":"maven"}]}],"references":["https://support.pentaho.com/hc/en-us/articles/34296654642701--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Handling-of-Insufficient-Permissions-or-Privileges-Versions-before-10-2-0-0-and-9-3-0-9-including-8-3-x-Impacted-CVE-2024-6697"],"weaknesses":["CWE-280"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/6xxx/CVE-2024-6697.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-6697","state":"PUBLISHED","datePublished":"2025-02-19T23:32:18.713Z","dateUpdated":"2025-02-20T17:23:54.281Z","assignerShortName":"HITVAN","assignerOrgId":"dce6e192-ff49-4263-9134-f0beccb9bc13","dateReserved":"2024-07-11T15:18:02.001Z"},"containers":{"cna":{"title":"Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges","descriptions":[{"lang":"en","value":"The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280)\n\n\n\n \n\n\n\nHitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service.\n\n\n\n \n\n\n\nAn adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact."}],"affected":[{"vendor":"Hitachi Vantara","product":"Pentaho Data Integration & Analytics","defaultStatus":"unaffected","versions":[{"version":"10.0","status":"affected","lessThan":"10.2.0.0","versionType":"maven"}]},{"vendor":"Hitachi Vantara","product":"Pentaho Business Analytics Server","defaultStatus":"unaffected","versions":[{"version":"1.0","status":"affected","lessThan":"9.3.0.9","versionType":"maven"}]}],"references":[{"url":"https://support.pentaho.com/hc/en-us/articles/34296654642701--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Handling-of-Insufficient-Permissions-or-Privileges-Versions-before-10-2-0-0-and-9-3-0-9-including-8-3-x-Impacted-CVE-2024-6697"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-280","description":"CWE-280: Improper Handling of Insufficient Permissions or Privileges","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"HITVAN","orgId":"dce6e192-ff49-4263-9134-f0beccb9bc13","dateUpdated":"2025-02-19T23:32:18.713Z"},"credits":[{"lang":"en","type":"finder","value":"Hitachi Group Member"}],"impacts":[{"capecId":"CAPEC-212","descriptions":[{"lang":"en","value":"CAPEC-212 Functionality Misuse"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-20T17:23:21.950806Z","id":"CVE-2024-6697","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-20T17:23:54.281Z"}}]}}}