Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2025-11158

Hitachi Vantara Pentaho Data Integration & Analytics - Missing Authorization

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HITVAN

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Hitachi Vantara Pentaho Data Integration and Analytics

Default version status: unaffected

  • 1.0 to ≤ 9.3.*affected
  • 10.0 to < 10.2.0.6affected

References