Advisories · Technology

Hitachi Vantara Pentaho Business Analytics Server.

Every CVE that names Hitachi Vantara Pentaho Business Analytics Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-24911 CVE record

CVSS 4.9 Medium

Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference
- Hitachi Vantara Pentaho Business Analytics Server
- XML external entities (XXE)
Not analysed yet 16 Apr 2025
CVE-2025-24910 CVE record

CVSS 4.9 Medium

Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference
- Hitachi Vantara Pentaho Business Analytics Server
- XML external entities (XXE)
Not analysed yet 16 Apr 2025
CVE-2025-24909 CVE record

CVSS 4.4 Medium

Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Hitachi Vantara Pentaho Business Analytics Server
- Cross-site scripting (XSS)
Not analysed yet 16 Apr 2025
CVE-2025-0757 CVE record

CVSS 4.4 Medium

Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Hitachi Vantara Pentaho Business Analytics Server
- Cross-site scripting (XSS)
Not analysed yet 16 Apr 2025
CVE-2025-0758 CVE record

CVSS 6.1 Medium

Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource
- Hitachi Vantara Pentaho Business Analytics Server
- Broken access control
Not analysed yet 16 Apr 2025
CVE-2024-37363 CVE record

CVSS 6.5 Medium

Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization
- Hitachi Vantara Pentaho Data Integration & Analytics
- Hitachi Vantara Pentaho Business Analytics Server
- Broken access control
Not analysed yet 19 Feb 2025
CVE-2024-37362 CVE record

CVSS 6.3 Medium

Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials
- Hitachi Vantara Pentaho Data Integration & Analytics
- Hitachi Vantara Pentaho Business Analytics Server
- Hard-coded credentials
Not analysed yet 19 Feb 2025
CVE-2024-6697 CVE record

CVSS 6.5 Medium

Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges
- Hitachi Vantara Pentaho Data Integration & Analytics
- Hitachi Vantara Pentaho Business Analytics Server
- CWE-280
Not analysed yet 19 Feb 2025
CVE-2024-6696 CVE record

CVSS 4.9 Medium

Hitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access Control
- Hitachi Vantara Pentaho Data Integration & Analytics
- Hitachi Vantara Pentaho Business Analytics Server
- CWE-1220
Not analysed yet 19 Feb 2025
CVE-2024-37361 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data
- Hitachi Vantara Pentaho Data Integration & Analytics
- Hitachi Vantara Pentaho Business Analytics Server
- Insecure deserialization
Not analysed yet 19 Feb 2025
CVE-2024-37360 CVE record

CVSS 4.4 Medium

Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Hitachi Vantara Pentaho Data Integration & Analytics
- Hitachi Vantara Pentaho Business Analytics Server
- Cross-site scripting (XSS)
Not analysed yet 19 Feb 2025
CVE-2024-37359 CVE record

CVSS 8.6 High

Hitachi Vantara Pentaho Business Analytics Server – Server Side Request Forgery
- Hitachi Vantara Pentaho Data Integration & Analytics
- Hitachi Vantara Pentaho Business Analytics Server
- Server-side request forgery (SSRF)
Not analysed yet 19 Feb 2025
CVE-2024-5705 CVE record

CVSS 8.8 High

Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization
- Hitachi Vantara Pentaho Data Integration & Analytics
- Hitachi Vantara Pentaho Business Analytics Server
- Broken access control
Not analysed yet 19 Feb 2025
CVE-2024-5706 CVE record

CVSS 8.8 High

Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')
- Hitachi Vantara Pentaho Data Integration & Analytics
- Hitachi Vantara Pentaho Business Analytics Server
- CWE-99
Not analysed yet 19 Feb 2025
CVE-2024-28984 CVE record

CVSS 8.8 High

Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Hitachi Vantara Pentaho Business Analytics Server
- Cross-site scripting (XSS)
Not analysed yet 26 Jun 2024
CVE-2024-28983 CVE record

CVSS 8.8 High

Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Hitachi Vantara Pentaho Business Analytics Server
- Cross-site scripting (XSS)
Not analysed yet 26 Jun 2024
CVE-2024-28982 CVE record

CVSS 7.1 High

Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference
- Hitachi Vantara Pentaho Business Analytics Server
- Denial of service
Not analysed yet 26 Jun 2024
CVE-2023-2358 CVE record

CVSS 4.3 Medium

Hitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable Format
- Hitachi Vantara Pentaho Business Analytics Server
- CWE-257
Not analysed yet 26 Sept 2023
CVE-2022-4815 CVE record

CVSS 8.0 High

Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data
- Hitachi Vantara Pentaho Business Analytics Server
- Insecure deserialization
Not analysed yet 24 May 2023
CVE-2023-1158 CVE record

CVSS 4.3 Medium

Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization
- Hitachi Vantara Pentaho Business Analytics Server
- Broken access control
Not analysed yet 24 May 2023
CVE-2022-43770 CVE record

CVSS 5.4 Medium

Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization
- Hitachi Vantara Pentaho Business Analytics Server
- Broken access control
Not analysed yet 11 Apr 2023
CVE-2022-3695 CVE record

CVSS 6.5 Medium

Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation
- Hitachi Vantara Pentaho Business Analytics Server
- Cross-site scripting (XSS)
Not analysed yet 11 Apr 2023
CVE-2022-4771 CVE record

CVSS 5.4 Medium

Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Hitachi Vantara Pentaho Business Analytics Server
- Cross-site scripting (XSS)
Not analysed yet 3 Apr 2023
CVE-2022-4770 CVE record

CVSS 4.3 Medium

Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information
- Hitachi Vantara Pentaho Business Analytics Server
- Information disclosure
Not analysed yet 3 Apr 2023
CVE-2022-4769 CVE record

CVSS 4.3 Medium

Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information
- Hitachi Vantara Pentaho Business Analytics Server
- Information disclosure
Not analysed yet 3 Apr 2023
CVE-2022-43772 CVE record

CVSS 3.8 Low

Hitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File
- Hitachi Vantara Pentaho Business Analytics Server
- Information disclosure
Not analysed yet 3 Apr 2023
CVE-2022-3960 CVE record

CVSS 6.3 Medium

Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
- Hitachi Vantara Pentaho Business Analytics Server
- Code injection
Not analysed yet 3 Apr 2023
CVE-2022-43941 CVE record

CVSS 7.1 High

Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference
- Hitachi Vantara Pentaho Business Analytics Server
- XML external entities (XXE)
Not analysed yet 3 Apr 2023
CVE-2022-43771 CVE record

CVSS 6.5 Medium

Hitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Hitachi Vantara Pentaho Business Analytics Server
- Path traversal
Not analysed yet 3 Apr 2023
CVE-2022-43940 CVE record

CVSS 8.8 High

Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization
- Hitachi Vantara Pentaho Business Analytics Server
- Broken access control
Not analysed yet 3 Apr 2023
CVE-2022-43939 CVE record

CVSS 8.6 HighCritical · KEV, CVSS 7+ and EPSSKEV

Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions
- Hitachi Vantara Pentaho Business Analytics Server
- CWE-647
Not analysed yet 3 Apr 2023
CVE-2022-43938 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
- Hitachi Vantara Pentaho Business Analytics Server
- Code injection
Not analysed yet 3 Apr 2023
CVE-2022-43773 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource
- Hitachi Vantara Pentaho Business Analytics Server
- Broken access control
Not analysed yet 3 Apr 2023
CVE-2022-43769 CVE record

CVSS 8.8 HighCritical · KEV, CVSS 7+ and EPSSKEV

Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
- Hitachi Vantara Pentaho Business Analytics Server
- Other injection
Not analysed yet 3 Apr 2023
CVE-2021-45448 CVE record

CVSS 7.1 High

Pentaho Business Analytics Server - Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user supplied path to access resources that are out of bounds.
- Hitachi Vantara Pentaho Business Analytics Server
- Path traversal
Not analysed yet 2 Nov 2022
CVE-2021-45447 CVE record

CVSS 7.7 High

Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear text
- Hitachi Vantara Pentaho Business Analytics Server
- Weak cryptography or TLS
Not analysed yet 2 Nov 2022
CVE-2021-45446 CVE record

CVSS 5.0 Medium

Pentaho Business Analytics Server - Exposure of Information Through Directory Listing
- Hitachi Vantara Pentaho Business Analytics Server
- CWE-548
Not analysed yet 2 Nov 2022