CVE-2020-24669

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The New Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a DOM-based Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'Analysis Report Description' field in 'About this Report' section. Remediated in >= 8.3.0.9, >= 9.0.0.1, and >= 9.1.0.0 GA.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 29, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-246705.4The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an a CVE-2020-246718.8Trace Financial CRESTBridge <6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03.CVE-2020-246729.8A vulnerability in Base Software for SoftControl allows an attacker to insert and run arbitrary code in a computer running the affected prod CVE-2020-246739.8In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data (Inser CVE-2020-246748.8In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remot CVE-2020-246759.8In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations History server (or standa CVE-2020-246767.8In Symphony Plus Operations and Symphony Plus Historian, some services can be vulnerable to privilege escalation attacks. An unprivileged (b CVE-2020-246778.8Vulnerabilities in the S+ Operations and S+ Historian web applications can lead to a possible code execution and privilege escalation, redir CVE-2020-246788.8An authenticated user might execute malicious code under the user context and take control of the system. S+ Operations or S+ Historian data CVE-2020-246799.8A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash o CVE-2020-246807.0In S+ Operations and S+ Historian, the passwords of internal users (not Windows Users) are encrypted but improperly stored in a database.CVE-2020-246818.8Incorrect Permission Assignment for Critical Resource vulnerability in B&R Industrial Automation Automation Studio allows Privilege Escalati