fkie_cve-2025-0757
Vulnerability from fkie_nvd
Published
2025-04-16 23:15
Modified
2025-04-17 20:21
Severity ?
4.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
Summary
Overview   The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79)   Description   Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface.   Impact   Once the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site.
References
security.vulnerabilities@hitachivantara.comhttps://support.pentaho.com/hc/en-us/articles/35781038882445--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Neutralization-of-Input-During-Web-Page-Generation-Cross-site-Scripting-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0757
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Overview\n\n\n\n\u00a0\n\n\n\nThe software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79) \n\n\n\n\u00a0\n\n\n\nDescription \n\n\n\n\u00a0\n\n\n\nHitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface. \n\n\n\n\u00a0\n\n\n\nImpact \n\n\n\n\u00a0\n\n\n\nOnce the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim\u0027s machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site."
    },
    {
      "lang": "es",
      "value": "Descripci\u00f3n general, el software no neutraliza o neutraliza incorrectamente la entrada controlable por el usuario antes de que se coloque en la salida que se usa como una p\u00e1gina web que se sirve a otros usuarios. (CWE-79) Descripci\u00f3n: Hitachi Vantara Pentaho Business Analytics Server anteriores a las versiones 10.2.0.2, incluidas 9.3.x y 8.3.x, permiten que una URL maliciosa inyecte contenido en la interfaz del complemento Analyzer. Impacto Una vez que se inyecta el script malicioso, el atacante puede realizar una variedad de actividades maliciosas. El atacante podr\u00eda transferir informaci\u00f3n privada, como cookies que pueden incluir informaci\u00f3n de sesi\u00f3n, desde la m\u00e1quina de la v\u00edctima al atacante. El atacante podr\u00eda enviar solicitudes maliciosas a un sitio web en nombre de la v\u00edctima, lo que podr\u00eda ser especialmente peligroso para el sitio si la v\u00edctima tiene privilegios de administrador para administrar ese sitio."
    }
  ],
  "id": "CVE-2025-0757",
  "lastModified": "2025-04-17T20:21:48.243",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.7,
        "impactScore": 3.6,
        "source": "security.vulnerabilities@hitachivantara.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-04-16T23:15:44.530",
  "references": [
    {
      "source": "security.vulnerabilities@hitachivantara.com",
      "url": "https://support.pentaho.com/hc/en-us/articles/35781038882445--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Neutralization-of-Input-During-Web-Page-Generation-Cross-site-Scripting-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0757"
    }
  ],
  "sourceIdentifier": "security.vulnerabilities@hitachivantara.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security.vulnerabilities@hitachivantara.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.