PT-2025-7412 · Hitachi Vantara · Hitachi Vantara Pentaho Business Analytics Server

Published 2025-02-19 · Updated 2025-02-20 · CVE-2024-37363

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.0 and 9.3.0.8, including 8.3.x

Description The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This can lead to a wide range of problems, including information exposures and denial of service, as users can access data or perform actions that they should not be allowed to perform.

Recommendations For versions prior to 10.2.0.0, update to version 10.2.0.0 or later. For versions prior to 9.3.0.8, update to version 9.3.0.8 or later. As a temporary workaround, consider restricting access to the data source management service until a patch is available. Restrict access to sensitive data and resources to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-02154

CVE-2024-37363

Affected Products

Hitachi Vantara Pentaho Business Analytics Server

References · 6

• https://bdu.fstec.ru/vul/2025-02154 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-37363 · Security Note
• https://support.pentaho.com/hc/en-us/articles/34296230504589--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Incorrect-Authorization-Versions-before-10-2-0-0-and-9-3-0-8-including-8-3-x-Impacted-CVE-2024-37363 · Note
• https://twitter.com/CVEnew/status/1892361112315920679 · Twitter Post
• https://vuldb.com/?id.296328 · Note
• https://t.me/cvedetector/18490 · Telegram Post