一、 漏洞 CVE-2024-6697 基础信息
漏洞标题
日立Vantara Pentaho Business Analytics Server权限处理不当漏洞
来源：AIGC 神龙大模型
漏洞描述信息
产品在权限不足而无法访问指定资源或功能时，未能正确处理此情况。这可能导致其遵循意外的代码路径，从而使产品处于无效状态。(CWE-280) Hitachi Vantara Pentaho Business Analytics Server 版本早于 10.2.0.0 和 9.3.0.9，包括 8.3.x，未能正确处理无效和缺失的权限，导致服务拒绝。 攻击者利用应用程序的合法功能，以某种方式实现负面技术影响。
来源：AIGC 神龙大模型
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
来源：AIGC 神龙大模型
漏洞类别
缺省权限不正确
来源：AIGC 神龙大模型
漏洞标题
Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges
来源：美国国家漏洞数据库 NVD
漏洞描述信息
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280)   Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service.   An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact.
来源：美国国家漏洞数据库 NVD
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
来源：美国国家漏洞数据库 NVD
漏洞类别
不充分权限或特权的处理不恰当
来源：美国国家漏洞数据库 NVD
二、漏洞 CVE-2024-6697 的公开POC
# POC 描述 源链接 神龙链接
三、漏洞 CVE-2024-6697 的情报信息

  • 标题： (Resolved) Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges - Versions before 10.2.0.0 and 9.3.0.9, including 8.3.x Impacted (CVE-2024-6697) – Pentaho Customer Portal -- 🔗来源链接

    标签：

    (Resolved) Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges - Versions before 10.2.0.0 and 9.3.0.9, including 8.3.x Impacted (CVE-2024-6697) – Pentaho Customer Portal
  • https://nvd.nist.gov/vuln/detail/CVE-2024-6697