Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2025-0758 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Overview The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732) Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, is installed with Karaf JMX beans enabled and accessible by default. Impact When the vulnerability is leveraged, a user with local execution privileges can access functionality exposed by Karaf beans contained in the product.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.1 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CNA: [email protected]CVSS-B:6.1 MEDIUMVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://support.pentaho.com/hc/en-us/articles/35781318194061--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Incorrect-Permission-Assignment-for-Critical-Resource-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0758	[email protected]	AdvisoryBroken LinkVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-732	Incorrect Permission Assignment for Critical Resource	[email protected]

Affected Products

Product	Versions
Hitachi Vantara Pentaho Business Analytics Server	~9.3 ~8.3
CPE cpe:2.3:a:hitachi:vantara_pentaho_business_analytics_server:::::::: Remediation Upgrade: 10.2.0.2moderate effort

Change History

3 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Apr 16, 2025	New CVE Received	[email protected]