Hitachi Vantara Pentaho Business Analytics Server Cross-Site Scripting Vulnerability in Analyzer Plugin

A cross-site scripting vulnerability has been identified in Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.2, including 9.3.x and 8.3.x. The issue arises because the software fails to properly neutralize user-controllable input before it is outputted as a web page for other users. This flaw allows a malicious URL to inject content into the Analyzer plugin interface.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts can be executed in the context of the user's browser. This could enable an attacker to steal cookies containing session information or to perform actions on behalf of the victim, particularly if the victim has administrative rights on the targeted website.