CVE-2025-0758 (GCVE-0-2025-0758)
Vulnerability from cvelistv5
Published
2025-04-16 22:12
Modified
2025-04-17 13:10
Severity ?
6.1 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
CWE
  • CWE-732 - Incorrect Permission Assignment for Critical Resource
Summary
Overview  The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732)  Description  Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, is installed with Karaf JMX beans enabled and accessible by default.  Impact  When the vulnerability is leveraged, a user with local execution privileges can access functionality exposed by Karaf beans contained in the product.
References
Impacted products
Vendor Product Version
Hitachi Vantara Pentaho Business Analytics Server Version: 1.0
Version: 10.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-0758",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-17T13:10:31.532081Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-17T13:10:38.993Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pentaho Business Analytics Server",
          "vendor": "Hitachi Vantara",
          "versions": [
            {
              "lessThanOrEqual": "9.3.*",
              "status": "affected",
              "version": "1.0",
              "versionType": "maven"
            },
            {
              "lessThan": "10.2.0.2",
              "status": "affected",
              "version": "10.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Hitachi Group Member"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cp\u003eOverview\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732)\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eDescription\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eHitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, is installed with Karaf JMX beans enabled and accessible by default.\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eImpact\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eWhen the vulnerability is leveraged, a user with local execution privileges can access functionality exposed by Karaf beans contained in the product.\u0026nbsp;\u003c/p\u003e\u003c/div\u003e"
            }
          ],
          "value": "Overview\u00a0\n\n\n\nThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732)\u00a0\n\n\n\nDescription\u00a0\n\n\n\nHitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, is installed with Karaf JMX beans enabled and accessible by default.\u00a0\n\n\n\nImpact\u00a0\n\n\n\nWhen the vulnerability is leveraged, a user with local execution privileges can access functionality exposed by Karaf beans contained in the product."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-16T22:13:52.521Z",
        "orgId": "dce6e192-ff49-4263-9134-f0beccb9bc13",
        "shortName": "HITVAN"
      },
      "references": [
        {
          "url": "https://support.pentaho.com/hc/en-us/articles/35781318194061--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Incorrect-Permission-Assignment-for-Critical-Resource-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0758"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dce6e192-ff49-4263-9134-f0beccb9bc13",
    "assignerShortName": "HITVAN",
    "cveId": "CVE-2025-0758",
    "datePublished": "2025-04-16T22:12:29.724Z",
    "dateReserved": "2025-01-27T17:25:02.016Z",
    "dateUpdated": "2025-04-17T13:10:38.993Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-0758\",\"sourceIdentifier\":\"security.vulnerabilities@hitachivantara.com\",\"published\":\"2025-04-16T23:15:44.647\",\"lastModified\":\"2025-04-17T20:21:48.243\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Overview\u00a0\\n\\n\\n\\nThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732)\u00a0\\n\\n\\n\\nDescription\u00a0\\n\\n\\n\\nHitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, is installed with Karaf JMX beans enabled and accessible by default.\u00a0\\n\\n\\n\\nImpact\u00a0\\n\\n\\n\\nWhen the vulnerability is leveraged, a user with local execution privileges can access functionality exposed by Karaf beans contained in the product.\"},{\"lang\":\"es\",\"value\":\"Descripci\u00f3n general: El producto especifica los permisos para un recurso cr\u00edtico para la seguridad de forma que permita que actores no deseados lo lean o modifiquen. (CWE-732) Descripci\u00f3n: Hitachi Vantara Pentaho Business Analytics Server anterior a la versi\u00f3n 10.2.0.2, incluidas las versiones 9.3.x y 8.3.x, se instala con los beans Karaf JMX habilitados y accesibles de forma predeterminada. Impacto: Cuando se aprovecha la vulnerabilidad, un usuario con privilegios de ejecuci\u00f3n local puede acceder a la funcionalidad expuesta por los beans Karaf del producto.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security.vulnerabilities@hitachivantara.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":4.2}]},\"weaknesses\":[{\"source\":\"security.vulnerabilities@hitachivantara.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"references\":[{\"url\":\"https://support.pentaho.com/hc/en-us/articles/35781318194061--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Incorrect-Permission-Assignment-for-Critical-Resource-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0758\",\"source\":\"security.vulnerabilities@hitachivantara.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-0758\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-17T13:10:31.532081Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-17T13:10:35.498Z\"}}], \"cna\": {\"title\": \"Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource\", \"source\": {\"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Hitachi Group Member\"}], \"impacts\": [{\"capecId\": \"CAPEC-180\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Hitachi Vantara\", \"product\": \"Pentaho Business Analytics Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0\", \"versionType\": \"maven\", \"lessThanOrEqual\": \"9.3.*\"}, {\"status\": \"affected\", \"version\": \"10.0\", \"lessThan\": \"10.2.0.2\", \"versionType\": \"maven\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://support.pentaho.com/hc/en-us/articles/35781318194061--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Incorrect-Permission-Assignment-for-Critical-Resource-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0758\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Overview\\u00a0\\n\\n\\n\\nThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732)\\u00a0\\n\\n\\n\\nDescription\\u00a0\\n\\n\\n\\nHitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, is installed with Karaf JMX beans enabled and accessible by default.\\u00a0\\n\\n\\n\\nImpact\\u00a0\\n\\n\\n\\nWhen the vulnerability is leveraged, a user with local execution privileges can access functionality exposed by Karaf beans contained in the product.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003e\u003cp\u003eOverview\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732)\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eDescription\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eHitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, is installed with Karaf JMX beans enabled and accessible by default.\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eImpact\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eWhen the vulnerability is leveraged, a user with local execution privileges can access functionality exposed by Karaf beans contained in the product.\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-732\", \"description\": \"CWE-732 Incorrect Permission Assignment for Critical Resource\"}]}], \"providerMetadata\": {\"orgId\": \"dce6e192-ff49-4263-9134-f0beccb9bc13\", \"shortName\": \"HITVAN\", \"dateUpdated\": \"2025-04-16T22:13:52.521Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-0758\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-17T13:10:38.993Z\", \"dateReserved\": \"2025-01-27T17:25:02.016Z\", \"assignerOrgId\": \"dce6e192-ff49-4263-9134-f0beccb9bc13\", \"datePublished\": \"2025-04-16T22:12:29.724Z\", \"assignerShortName\": \"HITVAN\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.