CVE-2024-37363: Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862)
Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, do not correctly perform an authorization check in the data source management service.
When access control checks are incorrectly applied, users can access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures and denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37363?
CVE-2024-37363 has a high severity due to the lack of proper authorization checks for accessing sensitive resources.
How do I fix CVE-2024-37363?
To fix CVE-2024-37363, upgrade to Hitachi Vantara Pentaho Business Analytics Server version 10.2.0.0 or 9.3.0.8 or later.
What versions of Hitachi Vantara Pentaho Business Analytics Server are affected by CVE-2024-37363?
Versions affected by CVE-2024-37363 include all versions before 10.2.0.0, 9.3.0.8, and the 8.3.x series.
What is the nature of the vulnerability in CVE-2024-37363?
CVE-2024-37363 is categorized as an Incorrect Authorization vulnerability, allowing unauthorized access to resources.
Is there a workaround for CVE-2024-37363?
Currently, there are no official workarounds for CVE-2024-37363 other than upgrading the software to a safe version.