CVE-2025-24908: Hitachi Vantara Pentaho Data Integration & Analytics

Описание

Оригинално описание

Overview   The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)   Description   Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the UploadFile service.   Impact   This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.

Засегнати продукти

• Hitachi Vantara Pentaho Data Integration & Analytics: 1.0 до 9.3.*; 10.0 преди 10.2.0.2

Вид слабост

• CWE-35 Обхождане на директории: '.../...//'

История

Други уязвимости в Hitachi Vantara Pentaho Data Integration & Analytics

• 6.8CVE-2025-24907
• 9.1CVE-2025-0756
• 6.5CVE-2024-37363
• 6.3CVE-2024-37362
• 6.5CVE-2024-6697

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2025-24908
• https://nvd.nist.gov/vuln/detail/CVE-2025-24908
• https://support.pentaho.com/hc/en-us/articles/35783399569421--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Path-Traversal-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24908