Medium severity · published Dec 15, 2025
CVE-2025-9122
Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full server stack trace when encountering an error within the GetCdfResource servlet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PD
Pentaho Data Integration and Analytics · Hitachi Vantara
1.0 before 10.2.0.4 · source: vendor
Affected product
PD
Pentaho Data Integration and Analytics
Hitachi Vantara
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9122
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9122
support.pentaho.com
https://support.pentaho.com/hc/en-us/articles/41833799577741--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Generation-of-Error-Message-Containing-Sensitive-Information-Versions-before-10-2-0-4-Impacted-CVE-2025-9122
More from Pentaho Data Integration and Analytics
9.1
CVE-2025-11158
Hitachi Vantara Pentaho Data Integration & Analytics - Missing Authorization
8.8
CVE-2025-9121
Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data
7.7
CVE-2026-2253
Hitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity Reference
7.2
CVE-2025-11159
Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component
6.3
CVE-2026-2254
Hitachi Vantara Pentaho Data Integration & Analytics - Incorrect Permission Assignment for Critical Resource