---
cve: "CVE-2024-37361"
severity: "CRITICAL"
cvss: 9.9
epss: "50%"
vendor: "Hitachi Vantara"
kev: false
exploited: false
published: "2025-02-20 00:15:19"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-09-06T22:41:55+02:00"
---

# CVE-2024-37361

> 9.9 CRITICAL

## Beschreibung

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502)



 



Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.



 



When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-502** — Deserialization of Untrusted Data
  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

## Angriffsmuster (CAPEC)

- [CAPEC-586 — Object Injection](https://capec.mitre.org/data/definitions/586.html) _(Severity: High)_

## Referenzen

- <https://support.pentaho.com/hc/en-us/articles/34299135441805--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Deserialization-of-Untrusted-Data-Versions-before-10-2-0-0-and-9-3-0-9-including-8-3-x-Impacted-CVE-2024-37361>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2024-37361) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_