Cross-site Scripting Vulnerability in Hitachi Vantara Pentaho Business Analytics Server

CVE-2024-37360

Summary

The Hitachi Vantara Pentaho Business Analytics Server is vulnerable to Cross-site Scripting due to improper sanitization of user-controlled input. This vulnerability allows attackers to inject malicious scripts into the Analyzer plugin interface, potentially leading to the theft of sensitive information, such as session cookies, and the ability to perform actions on behalf of the victim. It is crucial for users of versions prior to 10.2.0.0 and 9.3.0.9, including 8.3.x, to apply security updates to mitigate risks associated with this vulnerability.

References