CVE-2024-37287

A vendor fix is available.

• FixedVerve Reportingcisa_csaf_ot

  Disable Machine Learning *-* Machine learning can be disabled in the Elasticsearch configuration override. Contact Verve support for assistance if needed. *-* Connect to the Reporting server via SSH or terminal. *-* Copy the Elasticsearch configuration override to the working directory. *-* docker exec $(docker ps --filter "name=Reporting_elasticsearch" --format "{{ .ID }}") cat /usr/share/elasticsearch/config-templates/elasticsearch.override.yml > elasticsearch.override.yml *-* *-* *-* Add the following line and save. *-* xpack.ml.enabled: false *-* *-* *-* Disable Verve Reporting from the Verve Software Manager. *-* Update the Elasticsearch configuration override. *-* docker config rm elasticsearchymloverride *-* docker config create elasticsearchymloverride ./elasticsearch.override.yml *-* *-* *-* Enable Verve Reporting from the Verve Software Manager and confirm that the application starts and "Machine Learning" is no longer listed in the main navigation bar under Analytics. *-* Delete the copy of the Elasticsearch configuration override. *-* rm elasticsearch.override.yml

• MitigationVerve Reportingcisa_csaf_ot

  Access to the built-in "verve" account should be limited to only administrators who need to perform administrative functions and should only be used for administrative purposes. Separate accounts should be used for day-to-day functions.