CRITICAL🇵🇱 Wersja polska

CVE-2025-11159

CVSS 9.1v3.1pub. 2026-05-13upd. 2026-06-02

Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Hitachi Vantara Pentaho Data Integration And Analytics

    APP
    Hitachi
    < 10.2.0.7
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-11158CRITICAL9.1PL ✓ten sam produkt

RCE przez brak restrykcji skryptów Groovy w raportach PRPT — Pentaho

CVE-2026-2253HIGH7.7ten sam produkt

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x an...

CVE-2026-2254MEDIUM6.3ten sam produkt

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x an...

CVE-2026-2255MEDIUM4.3ten sam produkt

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x an...

CVE-2023-5617MEDIUM5.3ten sam produkt

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x an...