CVE-2024-37362: Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (CWE-522)
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when saving connections to RedShift.
Products must not disclose sensitive information without cause. Disclosure of sensitive information can lead to further exploitation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37362?
CVE-2024-37362 has a high severity rating due to its potential to allow unauthorized interception of authentication credentials.
How do I fix CVE-2024-37362?
To remediate CVE-2024-37362, update Hitachi Vantara Pentaho Data Integration & Analytics to version 10.2.0.0 or 9.3.0.8 or higher.
What versions are affected by CVE-2024-37362?
CVE-2024-37362 affects Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.0, 9.3.0.8, and all versions of 8.3.x.
What type of vulnerability is CVE-2024-37362?
CVE-2024-37362 is classified as a vulnerability related to insufficiently protected authentication credentials.
Can CVE-2024-37362 affect data security?
Yes, CVE-2024-37362 can significantly compromise data security by allowing attackers to intercept or retrieve sensitive authentication information.