[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fl96XQj-7Q5XKmAys_iX9tJHzAMK313CgCm06tjK3zT4":3,"g5a-ex:hitachi\u002Fvantara_pentaho@*":129,"g5a-family:hitachi\u002Fvantara_pentaho":131},{"success":4,"data":5},true,{"product":6,"versions":40,"topVulnerabilitiesByEpss":53,"kevVulnerabilities":106,"seoMetadata":107,"meta":126},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":39},"hitachi","vantara_pentaho",12,16,0,"2023-05-24",[14,17,19,21,23,25,27,29,31,33,35,37],{"version":15,"cve_count":11,"kev_count":11,"has_kev":16},"7.0.0",false,{"version":18,"cve_count":11,"kev_count":11,"has_kev":16},"7.1.0.25",{"version":20,"cve_count":11,"kev_count":11,"has_kev":16},"8.0.0",{"version":22,"cve_count":11,"kev_count":11,"has_kev":16},"8.2.0.6",{"version":24,"cve_count":11,"kev_count":11,"has_kev":16},"8.3.0.0",{"version":26,"cve_count":11,"kev_count":11,"has_kev":16},"8.3.0.25",{"version":28,"cve_count":11,"kev_count":11,"has_kev":16},"8.3.0.9",{"version":30,"cve_count":11,"kev_count":11,"has_kev":16},"9.0.0",{"version":32,"cve_count":11,"kev_count":11,"has_kev":16},"9.0.0.1",{"version":34,"cve_count":11,"kev_count":11,"has_kev":16},"9.1.0.0",{"version":36,"cve_count":11,"kev_count":11,"has_kev":16},"9.1.0.1",{"version":38,"cve_count":11,"kev_count":11,"has_kev":16},"9.2.0.2","Vantara Pentaho by Hitachi is a technology product with 12 tracked versions and 16 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[41,42,43,44,45,46,47,48,49,50,51,52],{"version":15,"cve_count":11,"kev_count":11,"has_kev":16},{"version":18,"cve_count":11,"kev_count":11,"has_kev":16},{"version":20,"cve_count":11,"kev_count":11,"has_kev":16},{"version":22,"cve_count":11,"kev_count":11,"has_kev":16},{"version":24,"cve_count":11,"kev_count":11,"has_kev":16},{"version":26,"cve_count":11,"kev_count":11,"has_kev":16},{"version":28,"cve_count":11,"kev_count":11,"has_kev":16},{"version":30,"cve_count":11,"kev_count":11,"has_kev":16},{"version":32,"cve_count":11,"kev_count":11,"has_kev":16},{"version":34,"cve_count":11,"kev_count":11,"has_kev":16},{"version":36,"cve_count":11,"kev_count":11,"has_kev":16},{"version":38,"cve_count":11,"kev_count":11,"has_kev":16},[54,62,68,73,78,84,89,94,98,103],{"cveId":55,"description":56,"publishedDate":57,"cvssScore":58,"cvssVersion":59,"severity":60,"isKev":16,"epssScore":61},"CVE-2021-31602","An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the applicationContext-spring-security.xml file. The default configuration allows an unauthenticated user with no previous knowledge of the platform settings to extract pieces of information without possessing valid credentials.","2021-11-08",7.5,"v3.1","High",0.51653,{"cveId":63,"description":64,"publishedDate":57,"cvssScore":65,"cvssVersion":59,"severity":66,"isKev":16,"epssScore":67},"CVE-2021-34684","Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data source and thus retrieve data from the related databases, as demonstrated by an api\u002Frepos\u002Fdashboards\u002Feditor URI.",9.8,"Critical",0.05868,{"cveId":69,"description":70,"publishedDate":57,"cvssScore":71,"cvssVersion":59,"severity":60,"isKev":16,"epssScore":72},"CVE-2021-31599","An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. A reports (.prpt) file allows the inclusion of BeanShell scripts to ease the production of complex reports. An authenticated user can run arbitrary code.",8.8,0.0234,{"cveId":74,"description":75,"publishedDate":57,"cvssScore":76,"cvssVersion":59,"severity":60,"isKev":16,"epssScore":77},"CVE-2021-34685","UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upload various files of different file types. Specifically, a .jsp file is not allowed, but a .jsp. file is allowed (and leads to remote code execution).",7.2,0.02322,{"cveId":79,"description":80,"publishedDate":57,"cvssScore":81,"cvssVersion":59,"severity":82,"isKev":16,"epssScore":83},"CVE-2021-31601","An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all databases connection details and credentials.",6.5,"Medium",0.0135,{"cveId":85,"description":86,"publishedDate":87,"cvssScore":81,"cvssVersion":59,"severity":82,"isKev":16,"epssScore":88},"CVE-2020-24665","The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an authenticated remote users to trigger a denial of service (DoS) condition. Specifically, the vulnerability lies in the 'dashboardXml' parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, >= 8.3.0.0 GA","2021-01-29",0.01089,{"cveId":90,"description":91,"publishedDate":57,"cvssScore":92,"cvssVersion":59,"severity":82,"isKev":16,"epssScore":93},"CVE-2021-31600","An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all valid usernames.",4.3,0.00982,{"cveId":95,"description":96,"publishedDate":12,"cvssScore":71,"cvssVersion":59,"severity":60,"isKev":16,"epssScore":97},"CVE-2022-4815","\nHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods. \n\n",0.00628,{"cveId":99,"description":100,"publishedDate":87,"cvssScore":101,"cvssVersion":59,"severity":82,"isKev":16,"epssScore":102},"CVE-2020-24664","The dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'pho:title' attribute of 'dashboardXml' parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, and >= 8.3.0.0 GA.",5.4,0.0062,{"cveId":104,"description":105,"publishedDate":87,"cvssScore":101,"cvssVersion":59,"severity":82,"isKev":16,"epssScore":102},"CVE-2020-24666","The Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a stored Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'Display Name' parameter. Remediated in >= 9.1.0.1",[],{"title":108,"metaDescription":109,"keywords":110,"structuredData":111},"Vantara Pentaho by Hitachi - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Vantara Pentaho by Hitachi covering 12 versions with 16 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Vantara Pentaho vulnerabilities, Vantara Pentaho security, Vantara Pentaho CVE, Hitachi Vantara Pentaho, Vantara Pentaho threat intelligence, Hitachi security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":112,"@type":113,"name":114,"description":109,"url":115,"manufacturer":116,"applicationCategory":120,"softwareVersion":121,"mainEntity":122},"https:\u002F\u002Fschema.org","SoftwareApplication","Vantara Pentaho","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fhitachi\u002Fvantara_pentaho",{"@type":117,"name":118,"url":119},"Organization","Hitachi","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fhitachi","Security Software","12 versions tracked",{"@type":123,"name":124,"description":125,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Vantara Pentaho Security Vulnerabilities","Security vulnerabilities affecting Vantara Pentaho by Hitachi",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":127,"apiVersion":128},"2026-10-17T00:05:46.080Z","3.0",{"rows":130,"total":11,"capped":16,"failed":11},[],[132,135,138],{"product":133,"cves":134},"vantara_pentaho_business_analytics_server",14,{"product":136,"cves":137},"vantara_pentaho_business_intelligence_server",4,{"product":139,"cves":140},"vantara_pentaho_data_integration_and_analytics",1]