CVE-2024-37363: Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization
First published: Wed Feb 19 2025(Updated: )
The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, do not correctly perform an authorization check in the data source management service. When access control checks are incorrectly applied, users can access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures and denial of service.
Credit: security.vulnerabilities@hitachivantara.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hitachi Vantara Pentaho Business Intelligence Server | <10.2.0.0>=9.3.0.8<=9.3.0.8>=8.3.0<8.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-37363?
CVE-2024-37363 has a high severity due to the lack of proper authorization checks for accessing sensitive resources.
How do I fix CVE-2024-37363?
To fix CVE-2024-37363, upgrade to Hitachi Vantara Pentaho Business Analytics Server version 10.2.0.0 or 9.3.0.8 or later.
What versions of Hitachi Vantara Pentaho Business Analytics Server are affected by CVE-2024-37363?
Versions affected by CVE-2024-37363 include all versions before 10.2.0.0, 9.3.0.8, and the 8.3.x series.
What is the nature of the vulnerability in CVE-2024-37363?
CVE-2024-37363 is categorized as an Incorrect Authorization vulnerability, allowing unauthorized access to resources.
Is there a workaround for CVE-2024-37363?
Currently, there are no official workarounds for CVE-2024-37363 other than upgrading the software to a safe version.
- collector/nvd-api
- source/NVD
- agent/references
- agent/weakness
- agent/description
- agent/type
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/source
- agent/first-publish-date
- agent/severity
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/hitachi vantara
- canonical/hitachi vantara pentaho business intelligence server