CVE-2024-6697

{"id": "CVE-2024-6697", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security.vulnerabilities@hitachivantara.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-02-20T00:15:20.010", "references": [{"url": "https://support.pentaho.com/hc/en-us/articles/34296654642701--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Handling-of-Insufficient-Permissions-or-Privileges-Versions-before-10-2-0-0-and-9-3-0-9-including-8-3-x-Impacted-CVE-2024-6697", "source": "security.vulnerabilities@hitachivantara.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security.vulnerabilities@hitachivantara.com", "description": [{"lang": "en", "value": "CWE-280"}]}], "descriptions": [{"lang": "en", "value": "The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280)\n\n\n\n\u00a0\n\n\n\nHitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service.\n\n\n\n\u00a0\n\n\n\nAn adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact."}, {"lang": "es", "value": "El producto no gestiona o gestiona incorrectamente cuando no tiene suficientes privilegios para acceder a los recursos o la funcionalidad seg\u00fan lo especificado por sus permisos. Esto puede provocar que siga rutas de c\u00f3digo inesperadas que pueden dejar al producto en un estado no v\u00e1lido. (CWE-280) Las versiones de Hitachi Vantara Pentaho Business Analytics Server anteriores a 10.2.0.0 y 9.3.0.9, incluida la 8.3.x, no manejan correctamente los permisos no v\u00e1lidos o faltantes, lo que da como resultado una denegaci\u00f3n de servicio. Un adversario aprovecha una capacidad leg\u00edtima de una aplicaci\u00f3n de tal manera que logra un impacto t\u00e9cnico negativo."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "security.vulnerabilities@hitachivantara.com"}