CVE-2024-37362

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (CWE-522)

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when saving connections to RedShift.

Products must not disclose sensitive information without cause. Disclosure of sensitive information can lead to further exploitation.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Feb 20, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-373636.5The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862) Hitac CVE-2024-373646.8Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensi CVE-2024-373657.8A remote code execution vulnerability exists in the affected product. The vulnerability allows users to save projects within the public dire CVE-2024-373677.5A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE v12. The vulnerability allows a user from a remot CVE-2024-373687.5A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote sy CVE-2024-373698.8A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassing CVE-2024-37379.8A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been rated as critical. Affected by this issue is the function findCount CVE-2024-373707.5In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, ca CVE-2024-373719.1In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message CVE-2024-373723.6The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not alw CVE-2024-373737.2Improper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated attacker with admin rights to ach CVE-2024-373767.2SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic