HIGH🇵🇱 Wersja polska

CVE-2026-2253

CVSS 7.7v3.1pub. 2026-05-27upd. 2026-07-24

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

  • Hitachi Vantara Pentaho Data Integration And Analytics

    APP
    Hitachi
    8.39.3< 10.2.0.7< 11.0.0.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-11159CRITICAL9.1PL ✓same product

Hitachi Vantara Pentaho – RCE przez podatny sterownik JDBC H2

CVE-2025-11158CRITICAL9.1PL ✓same product

RCE przez brak restrykcji skryptów Groovy w raportach PRPT — Pentaho

CVE-2026-2254MEDIUM6.3same product

Hitachi Vantara Pentaho Data Integration & Analytics w wersjach poniżej 10.2.0.6 i 11.0.0.0, w tym 9.3.x i 8.3...

CVE-2026-2255MEDIUM4.3same product

Wersje Hitachi Vantara Pentaho Data Integration & Analytics poprzedzające 10.2.0.6 i 11.0.0.0, w tym 10.2.0.6 ...

CVE-2023-5617MEDIUM5.3same product

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x an...