Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
Hitachi Vantara · Pentaho Business Analytics (BA) Server
Date added (CISA)
2025-03-03
Remediation due
2025-03-24
Known ransomware use
Not indicated
Remediation priority
P2 — past CISA due date
Description
Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.