CRITICAL🇵🇱 Wersja polska

CVE-2025-11158

CVSS 9.1v3.1pub. 2026-03-10upd. 2026-05-06

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Hitachi Vantara Pentaho Data Integration And Analytics

    APP
    Hitachi
    < 10.2.0.6
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-11159CRITICAL9.1PL ✓ten sam produkt

Hitachi Vantara Pentaho – RCE przez podatny sterownik JDBC H2

CVE-2026-2253HIGH7.7ten sam produkt

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x an...

CVE-2026-2254MEDIUM6.3ten sam produkt

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x an...

CVE-2026-2255MEDIUM4.3ten sam produkt

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x an...

CVE-2023-5617MEDIUM5.3ten sam produkt

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x an...