Hitachi Vantara Pentaho Data Integration and Analytics Groovy Script Execution Vulnerability Allowing Remote Code Execution

A remote code execution vulnerability exists in Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 10.2.0.6, including 9.3.x and 8.3.x. The vulnerability arises because the application does not properly restrict Groovy scripts in new PRPT reports published by users. This lack of restriction allows the insertion of arbitrary scripts, which can be executed remotely.

Impact

Exploitation of this vulnerability allows unauthorized users to execute arbitrary code on the server where Pentaho Data Integration and Analytics is running.

Remediation

Users are advised to upgrade to Hitachi Vantara Pentaho Data Integration & Analytics version 10.2.0.6 or later. This vulnerability is also addressed in Pentaho Data Integration & Analytics 11.0.