CVE-2024-37361

Summary

CVE-2024-37361 is a deserialization vulnerability affecting Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x. The issue lies in the application's handling of untrusted JSON data, which is deserialized without proper validation or constraint to approved classes and methods (CWE-502). Attackers can exploit this vulnerability by leveraging "gadget chains" – sequences of instances and method invocations that can be self-executed during deserialization – to perform unauthorized actions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.