CVE-2025-24908

Overview   The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)   Description   Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the UploadFile service.   Impact   This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.

Score
CVSS 3.1 6.8 Medium
Status
Deferred - security.vulnerabilities@hitachivantara.com
Published
2025-04-16
Last modified
2025-04-17
Weaknesses
CWE-35

Affected products

References

 
 
© AVABIS GmbH privacypolicy about