CVE-2024-6697

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280)   Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service.   An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact.

• CWE-280

• https://support.pentaho.com/hc/en-us/articles/34296654642701--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Handling-of-Insufficient-Permissions-or-Privileges-Versions-before-10-2-0-0-and-9-3-0-9-including-8-3-x-Impacted-CVE-2024-6697

Published

Feb 20, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-6691The Easy Digital Downloads – Sell Digital Files & Subscripti…4
• CVE-2024-6692The Easy Digital Downloads – Sell Digital Files & Subscripti…3.1
• CVE-2024-6693The wccp-pro WordPress plugin before 15.3 does not sanitise …4.8
• CVE-2024-6694The WP Mail SMTP plugin for WordPress is vulnerable to infor…2.7
• CVE-2024-6695it's possible for an attacker to gain administrative access …9.8
• CVE-2024-6696The product implements access controls via a policy or other…4.9
• CVE-2024-6698The FundEngine plugin for WordPress is vulnerable to privile…8.8
• CVE-2024-6699Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2024-6700Pega Platform versions 8.1 to Infinity 24.1.2 are affected b…4.8
• CVE-2024-6701Pega Platform versions 8.1 to Infinity 24.1.2 are affected b…4.8
• CVE-2024-6702Pega Platform versions 8.1 to Infinity 24.1.2 are affected b…4.8
• CVE-2024-6703The Contact Form Plugin by Fluent Forms for Quiz, Survey, an…5.4