CVE-2025-11158

Katalog CVE

CVSS 9.1 · Critical EPSS 0,39%

Kerentanan Missing Authorization pada hitachi vantara pentaho data integration and analytics. Skor CVSS 3.1 9.1 (Critical) menurut hitachivantara.com.

Deskripsi (NVD)

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.

Rincian

Terbit di NVD

10 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber hitachivantara.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.pentaho.com/hc/en-us/articles/39975058295821--Resolved-Hitachi-Vantara-Pentaho-Data-Integratio... advisory pihak ketiga
• https://www.ox.security/blog/cve-2025-11158/ advisory pihak ketiga