VULNERABILITY INTELLIGENCE

CVE-2024-28982

CVSS score7.1 HIGH
EPSS probability0.38%
CISA KEVNot currently listed
Published2024-06-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Description

Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of the Pentaho User Console against XML External Entity Reference.

Weakness classification

  • security.vulnerabilities@hitachivantara.com: CWE-776
  • nvd@nist.gov: CWE-776

Primary references