CVE-2024-10205CWE-306

Authorization bypass vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer

Critical · published December 17, 2024

CVSS v3.1
9.4
EPSS
1%
Percentile
55.4
In the wild
Unconfirmed
What it is

🚨 An authentication bypass lets anyone gain unauthorized access to sensitive components in Hitachi Ops Center Analyzer and Infrastructure Analytics Advisor. That's a serious security hole! 🔥 Think of this as a hotel without front desk security — anyone can stroll right in and access the penthouse suite, even if they never booked a room. No reservations needed! If exploited, an attacker could easily access sensitive analytics data, manipulate configurations, or even disrupt operations. This could lead to severe data breaches or operational disruptions — a disaster waiting to happen!

Put simply

Think of this as a hotel without front desk security — anyone can stroll right in and access the penthouse suite, even if they never booked a room. No reservations needed! This vulnerability allows attackers to bypass authentication checks, enabling unauthorized access to components within Hitachi Ops Center Analyzer and Infrastructure Analytics Advisor, affecting multiple versions on Linux.

What to do

If exploited, an attacker could easily access sensitive analytics data, manipulate configurations, or even disrupt operations. This could lead to severe data breaches or operational disruptions — a disaster waiting to happen! To secure your environment, immediately upgrade to Hitachi Ops Center Analyzer version 11.0.3-00 or later, and for the Infrastructure Analytics Advisor, move to version 4.4.1-00 or higher. Ensure all systems are patched and conduct an audit of your user access controls. You've got this! Follow the steps to patch this vulnerability and keep your systems secure. 🛡️

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00779 · 55.4th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2024-12-17T01:16Z
EPSS history
Timeline
  • 17 DEC 01:16Z
    Authorization bypass vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer
    cvelistv5