CVE-2024-6696— Hitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access Control
Quick assessment
Affected
Hitachi Vantara Pentaho Data Integration & Analytics
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Hitachi Vantara Pentaho Business Analytics Server是日本日立制作所（Hitachi）公司的一个现代数据混合、集成和业务分析平台。 Hitachi Vantara Pentaho Business Analytics Server存在安全漏洞，该漏洞源于存在授权检查不正确，导致攻击者可绕过访问限制。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-6696
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access Control
Source: CVE Program / CVE List V5
Vulnerability Description
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. (CWE-1220)
Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not correctly perform an authorization check in the user console trash content
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1220
Source: CVE Program / CVE List V5
Vulnerability Title
Hitachi Vantara Pentaho Business Analytics Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Hitachi Vantara Pentaho Business Analytics Server是日本日立制作所（Hitachi）公司的一个现代数据混合、集成和业务分析平台。 Hitachi Vantara Pentaho Business Analytics Server存在安全漏洞，该漏洞源于存在授权检查不正确，导致攻击者可绕过访问限制。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Hitachi Vantara | Pentaho Data Integration & Analytics | 10.0 ~ 10.2.0.0 | - |
|
| Hitachi Vantara | Pentaho Business Analytics Server | 1.0 ~ 9.3.0.9 | - |
|
II. Public POCs for CVE-2024-6696
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-6696
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-6696 (1)
Same Patch Batch · Hitachi Vantara · 2025-02-19 · 9 CVEs total
| CVE-2024-37361 | 9.9 CRITICAL | Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data |
| CVE-2024-5706 | 8.8 HIGH | Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identi |
| CVE-2024-5705 | 8.8 HIGH | Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization |
| CVE-2024-37359 | 8.6 HIGH | Hitachi Vantara Pentaho Business Analytics Server – Server Side Request Forgery |
| CVE-2024-6697 | 6.5 MEDIUM | Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Perm |
| CVE-2024-37363 | 6.5 MEDIUM | Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization |
| CVE-2024-37362 | 6.3 MEDIUM | Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credential |
| CVE-2024-37360 | 4.4 MEDIUM | Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input Durin |
IV. Related Vulnerabilities
Same product: Pentaho Data Integration & Analytics
-
CVE-2025-24907
Hitachi Vantara Pentaho Data Integration & Analytics – Path -
CVE-2025-24908
Hitachi Vantara Pentaho Data Integration & Analytics – Path -
CVE-2025-0756
Hitachi Vantara Pentaho Data Integration & Analytics - Impro -
CVE-2024-37363
Hitachi Vantara Pentaho Business Analytics Server - Incorrec -
CVE-2024-37362
Hitachi Vantara Pentaho Data Integration & Analytics - Insuf
Same vendor: Hitachi Vantara
-
CVE-2026-2253
Hitachi Vantara Pentaho Data Integration & Analytics - Impro -
CVE-2026-2255
Hitachi Vantara Pentaho Data Integration & Analytics - Insuf -
CVE-2026-2254
Hitachi Vantara Pentaho Data Integration & Analytics - Incor -
CVE-2025-11159
Hitachi Vantara Pentaho Data Integration & Analytics - Depen -
CVE-2025-11158
Hitachi Vantara Pentaho Data Integration & Analytics - Missi
Same weakness: CWE-1220
-
CVE-2026-86338
Ash field policies do not filter-nil forbidden calculations -
CVE-2026-77480
SQL Server Elevation of Privilege Vulnerability -
CVE-2026-66814
Microsoft SQL Server Elevation of Privilege Vulnerability -
CVE-2026-69267
Windows Connected User Experiences and Telemetry Information -
CVE-2026-78216
AshLua eval read operations can read field-policy-protected
V. Comments for CVE-2024-6696
No comments yet