CVE-2024-37363CWE-862

Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization

Medium · published February 19, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
25.1
In the wild
Unconfirmed
What it is

The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862)

Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, do not correctly perform an authorization check in the data source management service.

When access control checks are incorrectly applied, users can access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures and denial of service.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00332 · 25.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-02-19T23:40Z
EPSS history
Timeline
  • 19 FEB 23:40Z
    Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization
    cvelistv5