Skip to content
Fencer Intel
medium 6.3

CVE-2024-37362 json

Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials

published last yr. modified 4mo ago also EUVD-2025-4638

cvss
6.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (CWE-522)

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when saving connections to RedShift.

Products must not disclose sensitive information without cause. Disclosure of sensitive information can lead to further exploitation.

Patch / fix

  • Hitachi Vantara Pentaho Data Integration & Analytics 10.2.0.0
  • Hitachi Vantara Pentaho Business Analytics Server 9.3.0.8

Is CVE-2024-37362 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected products

  • Hitachi Vantara Pentaho Data Integration & Analytics
  • Hitachi Vantara Pentaho Business Analytics Server

Classification

Weakness
  • CWE-522 Insufficiently Protected Credentials

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.