CVE-2024-37363— Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization
Quick assessment
Affected
Hitachi Vantara Pentaho Data Integration & Analytics
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Hitachi Vantara Pentaho Business Analytics Server是日本日立制作所（Hitachi）公司的一个现代数据混合、集成和业务分析平台。 Hitachi Vantara Pentaho Business Analytics Server存在安全漏洞，该漏洞源于未正确执行授权检查，会导致信息泄露。
Possible ATT&CK Techniques 1 AI
T1528 · Steal Application Access Token
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-37363
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization
Source: CVE Program / CVE List V5
Vulnerability Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862)
Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, do not correctly perform an authorization check in the data source management service.
When access control checks are incorrectly applied, users can access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures and denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Hitachi Vantara Pentaho Business Analytics Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Hitachi Vantara Pentaho Business Analytics Server是日本日立制作所（Hitachi）公司的一个现代数据混合、集成和业务分析平台。 Hitachi Vantara Pentaho Business Analytics Server存在安全漏洞，该漏洞源于未正确执行授权检查，会导致信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Hitachi Vantara | Pentaho Data Integration & Analytics | 10.0 ~ 10.2.0.0 | - |
|
| Hitachi Vantara | Pentaho Business Analytics Server | 1.0 ~ 9.3.0.8 | - |
|
II. Public POCs for CVE-2024-37363
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-37363
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-37363 (1)
Same Patch Batch · Hitachi Vantara · 2025-02-19 · 9 CVEs total
| CVE-2024-37361 | 9.9 CRITICAL | Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data |
| CVE-2024-5706 | 8.8 HIGH | Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identi |
| CVE-2024-5705 | 8.8 HIGH | Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization |
| CVE-2024-37359 | 8.6 HIGH | Hitachi Vantara Pentaho Business Analytics Server – Server Side Request Forgery |
| CVE-2024-6697 | 6.5 MEDIUM | Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Perm |
| CVE-2024-37362 | 6.3 MEDIUM | Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credential |
| CVE-2024-6696 | 4.9 MEDIUM | Hitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access Con |
| CVE-2024-37360 | 4.4 MEDIUM | Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input Durin |
IV. Related Vulnerabilities
Same product: Pentaho Data Integration & Analytics
-
CVE-2025-24907
Hitachi Vantara Pentaho Data Integration & Analytics – Path -
CVE-2025-24908
Hitachi Vantara Pentaho Data Integration & Analytics – Path -
CVE-2025-0756
Hitachi Vantara Pentaho Data Integration & Analytics - Impro -
CVE-2024-37362
Hitachi Vantara Pentaho Data Integration & Analytics - Insuf -
CVE-2024-6697
Hitachi Vantara Pentaho Business Analytics Server - Improper
Same vendor: Hitachi Vantara
-
CVE-2026-2253
Hitachi Vantara Pentaho Data Integration & Analytics - Impro -
CVE-2026-2255
Hitachi Vantara Pentaho Data Integration & Analytics - Insuf -
CVE-2026-2254
Hitachi Vantara Pentaho Data Integration & Analytics - Incor -
CVE-2025-11159
Hitachi Vantara Pentaho Data Integration & Analytics - Depen -
CVE-2025-11158
Hitachi Vantara Pentaho Data Integration & Analytics - Missi
Same weakness: CWE-862
-
CVE-2026-11601
WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated -
CVE-2026-94505
Nelio Content <= 4.5.0 - Missing Authorization to Authentica -
CVE-2026-101923
Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorizat -
CVE-2026-97337
Simple Membership <= 4.8.3 - Missing Authorization to Unauth -
CVE-2026-91108
Alt Text AI <= 1.10.41 - Missing Authorization to Authentica
V. Comments for CVE-2024-37363
No comments yet