CVE-2025-0758: Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource
Overview
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732)
Description
Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, is installed with Karaf JMX beans enabled and accessible by default.
Impact
When the vulnerability is leveraged, a user with local execution privileges can access functionality exposed by Karaf beans contained in the product.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0758?
The severity of CVE-2025-0758 is considered to be critical due to the potential for unauthorized access to sensitive resources.
How do I fix CVE-2025-0758?
To fix CVE-2025-0758, upgrade the Hitachi Vantara Pentaho Business Analytics Server to version 10.2.0.2 or later.
Which versions of Hitachi Vantara Pentaho Business Analytics Server are affected by CVE-2025-0758?
CVE-2025-0758 affects versions prior to 10.2.0.2, including 9.3.x and 8.3.x.
What type of vulnerability is CVE-2025-0758?
CVE-2025-0758 is classified as an incorrect permission assignment vulnerability, specifically CWE-732.
Can CVE-2025-0758 allow data exposure?
Yes, CVE-2025-0758 can potentially allow unauthorized actors to read or modify security-critical resources.