CVE-2024-0715 is a high severity expression language injection in Hitachi Global Link Manager on Windows, scored 7.6. Hitachi's advisory lists versions before 8.8.7-03 as affected and 8.8.7-03 as the fix, released on 20 February 2024. Upgrade to that version or later.
What's affected
The record says the issue affects Hitachi Global Link Manager before 8.8.7-03 on Windows and allows code injection. Hitachi security notice hitachi-sec-2024-112 agrees: affected is anything below 8.8.7-03 on Windows, and the fixed version is 8.8.7-03.
Both sources give the same score. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H: network reachable, low complexity, a low privilege account needed, no user interaction, with low impact on confidentiality and integrity and high impact on availability. The weakness is CWE-917, improper neutralization of special elements used in an expression language statement.
How to check if you're exposed
Open Hitachi Global Link Manager and check the version in the product's about information, or look in Windows Programs and Features for the installed version. Anything lower than 8.8.7-03 is affected.
Because the vector needs a low privilege account, also list who holds accounts in the tool. Fewer accounts, and tighter network access to the management server, reduce the number of people who could attempt the flaw.
What to do now
- Find each Windows host running Global Link Manager and record the version.
- Upgrade to 8.8.7-03 or later. Hitachi says to contact your support representative for details on fixed products.
- Review accounts on the tool and remove any that are no longer needed.
- Restrict network access to the management interface to the administration network.
- Follow Hitachi's note about removing end of support storage devices from management and monitoring targets, since the advisory suggests that reduces the impact of latent flaws.
Why it matters
Expression languages let applications evaluate small snippets of logic at run time. If user supplied text is passed into one without being neutralized, the application may evaluate more than the author intended. That is the idea behind this class of flaw, and the record describes the outcome as code injection.
Global Link Manager manages storage paths for servers, so an outage or tampering there can interrupt access to storage. That explains the high availability impact in the score. The record does not flag the CVE as known exploited, and Hitachi's notice does not state that it has been used in attacks. It lists no workaround other than upgrading.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Quick check
Is there a workaround?
The Hitachi notice lists no specific workaround. It advises removing end of support storage devices from management targets to limit the impact of latent flaws.
Does it affect Linux installations?
The record and the notice both name Windows. Check Hitachi's documentation for other platforms.
Sources
Last reviewed: 19 October 2026.
