Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Pentaho Business Analytics Server — Vulnerabilities & Security Advisories 28

All 28 CVE vulnerabilities found in Pentaho Business Analytics Server, with AI-generated Chinese analysis, references, and POCs.

This page aggregates documented security weaknesses associated with Pentaho Business Analytics Server, a business intelligence platform provided by Hitachi Vantara. The collection focuses on known software flaws reported for this specific product, spanning advisories published over several years of its operational history. Here, users can track the vendor’s security notifications, understand the specific class of vulnerabilities affecting the product, and review its complete vulnerability history without navigating between disparate sources.

Vendor: Hitachi Vantara

CVE ID Title CVSS Severity Published
CVE-2025-24911 Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference CWE-611 4.9 Medium 2025-04-16
CVE-2025-24910 Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference CWE-611 4.9 Medium 2025-04-16
CVE-2025-24909 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 4.4 Medium 2025-04-16
CVE-2025-0757 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 4.4 Medium 2025-04-16
CVE-2025-0758 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource CWE-732 6.1 Medium 2025-04-16
CVE-2024-28984 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 8.8 High 2024-06-26
CVE-2024-28983 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 8.8 High 2024-06-26
CVE-2024-28982 Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference CWE-776 7.1 High 2024-06-26
CVE-2023-2358 Hitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable Format CWE-257 4.3 Medium 2023-09-26
CVE-2022-4815 Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data CWE-502 8.0 High 2023-05-24
CVE-2023-1158 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization CWE-863 4.3 Medium 2023-05-24
CVE-2022-43770 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization CWE-863 5.4 Medium 2023-04-11
CVE-2022-3695 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation CWE-79 6.5 Medium 2023-04-11
CVE-2022-4771 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 5.4 Medium 2023-04-03
CVE-2022-4770 Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information CWE-209 4.3 Medium 2023-04-03
CVE-2022-4769 Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information CWE-209 4.3 Medium 2023-04-03
CVE-2022-43772 Hitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File CWE-532 3.8 Low 2023-04-03
CVE-2022-3960 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') CWE-96 6.3 Medium 2023-04-03
CVE-2022-43941 Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference CWE-611 7.1 High 2023-04-03
CVE-2022-43771 Hitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 6.5 Medium 2023-04-03
CVE-2022-43940 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization CWE-863 8.8 High 2023-04-03
CVE-2022-43939 Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions CWE-647 8.6 High 2023-04-03
CVE-2022-43938 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') CWE-96 8.8 High 2023-04-03
CVE-2022-43773 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource CWE-732 8.8 High 2023-04-03
CVE-2022-43769 Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) CWE-74 8.8 High 2023-04-03
CVE-2021-45448 Pentaho Business Analytics Server - Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user supplied path to access resources that are out of bounds. CWE-22 7.1 High 2022-11-02
CVE-2021-45447 Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear text CWE-319 7.7 High 2022-11-02
CVE-2021-45446 Pentaho Business Analytics Server - Exposure of Information Through Directory Listing CWE-548 5.0 Medium 2022-11-02

All 28 known CVE vulnerabilities affecting Pentaho Business Analytics Server with full Chinese analysis, references, and POCs where available.