CVE-2024-6697

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280)

 

Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service.

 

An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-280

Affected software

No affected versions have been published.

Timeline

Published
Feb 20, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-66988.8The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plCVE-2024-66999.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc. Mikafon MA7 alCVE-2024-67004.8Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.CVE-2024-67014.8Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.CVE-2024-67024.8Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.CVE-2024-67035.4The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored CrossCVE-2024-67046.1The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a CVE-2024-67055.5The RegLevel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.CVE-2024-67066.1Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.CVE-2024-67078.8Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability.CVE-2024-67084.8The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the aCVE-2024-67094.3The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t