CVE-2025-9121

Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.pentaho.com/hc/en-us/articles/41832536185613--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Deserialization-of-Untrusted-Data-Versions-before-10-2-0-4-Impacted-CVE-2025-9121

Configurations

No configuration.

History

07 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Las versiones del plugin Pentaho Data Integration and Analytics Community Dashboard Editor anteriores a 10.2.0.4, incluyendo 9.3.0.x y 8.3.x, deserializan datos JSON no confiables sin restringir el analizador a clases y métodos aprobados.

Information

Published : 2025-12-15 23:15

Updated : 2026-10-07 19:10

NVD link : CVE-2025-9121

Mitre link : CVE-2025-9121

CVE.ORG link : CVE-2025-9121

JSON object : View

Products Affected

No product.

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2025-9121", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9121", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-17T04:55:53.058795Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security.vulnerabilities@hitachivantara.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security.vulnerabilities@hitachivantara.com", "affectedData": [{"vendor": "Hitachi Vantara", "product": "Pentaho Data Integration and Analytics", "versions": [{"status": "affected", "version": "1.0", "lessThan": "10.2.0.4", "versionType": "maven"}], "packageName": "Community Dashboard Editor", "defaultStatus": "unaffected"}]}], "published": "2025-12-15T23:15:57.590", "references": [{"url": "https://support.pentaho.com/hc/en-us/articles/41832536185613--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Deserialization-of-Untrusted-Data-Versions-before-10-2-0-4-Impacted-CVE-2025-9121", "source": "security.vulnerabilities@hitachivantara.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security.vulnerabilities@hitachivantara.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods."}, {"lang": "es", "value": "Las versiones del plugin Pentaho Data Integration and Analytics Community Dashboard Editor anteriores a 10.2.0.4, incluyendo 9.3.0.x y 8.3.x, deserializan datos JSON no confiables sin restringir el analizador a clases y m\u00e9todos aprobados."}], "lastModified": "2026-10-07T19:10:00.160", "sourceIdentifier": "security.vulnerabilities@hitachivantara.com"}