CVE-2025-0758

published 2025-04-16

CVE-2025-0758: Overview The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors…

Priority P4 27 medium 6.1 CVSS 3.1

AV L AC L PR L UI N S U C L I N A H

Overview

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732)

Description

Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, is installed with Karaf JMX beans enabled and accessible by default.

Impact

When the vulnerability is leveraged, a user with local execution privileges can access functionality exposed by Karaf beans contained in the product.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
hitachi_vantara	pentaho_business_analytics_server	1.0 – 9.3.*	—
hitachi_vantara	pentaho_business_analytics_server	>= 10.0 < 10.2.0.2	10.2.0.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-732