CVE-2025-9122

Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full server stack trace when encountering an error within the GetCdfResource servlet.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.pentaho.com/hc/en-us/articles/41833799577741--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Generation-of-Error-Message-Containing-Sensitive-Information-Versions-before-10-2-0-4-Impacted-CVE-2025-9122

Configurations

No configuration.

History

07 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework anteriores a las versiones 10.2.0.4, incluyendo 9.3.0.x y 8.3.x muestran el rastreo completo de la pila del servidor al encontrar un error dentro del servlet GetCdfResource.

Information

Published : 2025-12-15 23:15

Updated : 2026-10-07 19:10

NVD link : CVE-2025-9122

Mitre link : CVE-2025-9122

CVE.ORG link : CVE-2025-9122

JSON object : View

Products Affected

No product.

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2025-9122", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9122", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-16T14:38:37.772980Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security.vulnerabilities@hitachivantara.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security.vulnerabilities@hitachivantara.com", "affectedData": [{"vendor": "Hitachi Vantara", "modules": ["Community Dashboard Framework"], "product": "Pentaho Data Integration and Analytics", "versions": [{"status": "affected", "version": "1.0", "lessThan": "10.2.0.4", "versionType": "maven"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-15T23:15:57.737", "references": [{"url": "https://support.pentaho.com/hc/en-us/articles/41833799577741--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Generation-of-Error-Message-Containing-Sensitive-Information-Versions-before-10-2-0-4-Impacted-CVE-2025-9122", "source": "security.vulnerabilities@hitachivantara.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security.vulnerabilities@hitachivantara.com", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full server stack trace when encountering an error within the GetCdfResource servlet."}, {"lang": "es", "value": "Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework anteriores a las versiones 10.2.0.4, incluyendo 9.3.0.x y 8.3.x muestran el rastreo completo de la pila del servidor al encontrar un error dentro del servlet GetCdfResource."}], "lastModified": "2026-10-07T19:10:00.160", "sourceIdentifier": "security.vulnerabilities@hitachivantara.com"}