CVE-2020-24669: The New Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a DOM-based Cross-site scripting vulnerability, which allows an authenticated…

PriorityP423medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.62%

45.2th percentile

The New Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a DOM-based Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'Analysis Report Description' field in 'About this Report' section. Remediated in >= 8.3.0.9, >= 9.0.0.1, and >= 9.1.0.0 GA.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
hitachi	vantara_pentaho	>= 7.0.0 < 8.3.0.9	8.3.0.9
hitachi	vantara_pentaho	>= 9.0.0 < 9.0.0.1	9.0.0.1

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.