Incorrect Permission Assignment for Critical Resource vulnerability has been discovered in OpenText™ Vertica.
Priority LOW 30CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privileges to Vertica agent apikey. This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00308 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenText | Vertica | 10.0 – 10.x; 11.0 – 11.x; 12.0 – 12.x; 23.0 – 23.x; 24.0 – 24.x | — | No fix listed | CNA |
- Vertica VendorOpenText Affected 10.0 – 10.x; 11.0 – 11.x; 12.0 – 12.x; 23.0 – 23.x; 24.0 – 24.x Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microfocus:vertica:*:*:*:*:*:*:*:* | 10.0.0-0 to before 12.0.4-30; 23.0.0-0 to before 23.3.0-11; 23.4.0-0 to before 23.4.0-13 | Vulnerable | Micro Focus International |
| cpe:2.3:a:opentext:vertica:*:*:*:*:*:*:*:* | 24.1.0-0 to before 24.1.0-8; 24.2.0-0 to before 24.2.0-4 | Vulnerable | OpenText |
| cpe:2.3:a:opentext:vertica:24.3.0-0:*:*:*:*:*:*:* | 24.3.0-0 | Vulnerable | OpenText |
- cpe:2.3:a:microfocus:vertica:*:*:*:*:*:*:*:* Versions 10.0.0-0 to before 12.0.4-30; 23.0.0-0 to before 23.3.0-11; 23.4.0-0 to before 23.4.0-13 Vulnerable ·Micro Focus International
- cpe:2.3:a:opentext:vertica:*:*:*:*:*:*:*:* Versions 24.1.0-0 to before 24.1.0-8; 24.2.0-0 to before 24.2.0-4 Vulnerable ·OpenText
- cpe:2.3:a:opentext:vertica:24.3.0-0:*:*:*:*:*:*:* Versions 24.3.0-0 Vulnerable ·OpenText
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-6360
- 2026-10-03 Alias added: GHSA-856w-qx7w-v664
References
More OpenText Vertica vulnerabilities
- TI-2016-01835 The validateAdminConfig handler in the Analytics Management Console in HPE Vertica 7.0.x… CVSS 3.0CRITICAL 9.8
- TI-2017-03740 A Remote Gain Privileged Access vulnerability in HPE Vertica Analytics Platform version v4.1 and later was found. CVSS 3.0CRITICAL 9.8
- TI-2023-06632 OpenText Vertica Management console might be prone to bypass via crafted requests CVSS 3.1CRITICAL 9.8
- TI-2015-05761 The vertica-udx-zygote process in HP Vertica 7.1.1 UDx does not require authentication… CVSS 2.0HIGH 7.5
- TI-2025-11430 Username Enumeration Observable Response Discrepancy vulnerability has been discovered in OpenText™ Vertica. CVSS 4.0MEDIUM 5.1
- TI-2025-11429 Improper neutralization of input during web page generation vulnerability has been discovered in OpenText™ Vertica. CVSS 4.0MEDIUM 5.1
Sources
- CVE-2024-6360 · CVE Program
- CVE-2024-6360 · NVD
- FIRST EPSS
- GHSA-856w-qx7w-v664 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences