CVE-2024-1113 is a medium-severity flaw in openBI, a business intelligence web application, with a CVSS score of 6.3. The record says versions up to 1.0.8 are affected and names no fixed release. Until you can confirm a patched build, treat internet exposure as the risk to remove first.
What's affected
The record lists openBI up to and including 1.0.8 as affected. The problem sits in the function uploadUnity of /application/index/controller/Unity.php, through the file argument. The record scores it 6.3, lower than the sibling upload flaws, which fits a vector with some limited impact ratings. Read the vector string in the NVD record for the exact breakdown.
The record names no fixed version, and the VulDB entry (VDB-252471) could not be read when I tried to fetch it. Check the openBI project directly for a patched release before you assume one exists.
How to check if you're exposed
Start with an inventory. Find every host that runs openBI and read the version from its install directory or deployment notes. Anything at or below 1.0.8 is in scope.
If you track dependencies and deployments in a repository, the free in-browser dependency scan will show whether openBI or a fork of it appears in your manifests. For a running server, look at your web access logs for requests to the path /application/index/controller/Unity.php from addresses you do not recognise. The advisory sources do not publish a fixed detection method, so treat log review as a hint and not a verdict.
What to do now
- Find every openBI instance and record its version and who can reach it.
- Check the project page and the VulDB entry for a fixed release. If none is published, plan to replace or retire the product.
- Take the instance off the public internet. Put it behind a VPN or an IP allow list while you decide.
- Review web server logs for the affected path and for unexpected changes on disk since the instance went live.
- If you cannot patch, block the Unity upload route at your reverse proxy.
- Add the product to your watch list so a later fix or follow up CVE reaches you quickly.
Why it matters
The weakness class is CWE-434 (unrestricted upload of a file with a dangerous type). Unrestricted upload lets a caller place a file on the server that the code should have refused.
A Medium score does not make an upload bug safe to ignore. Treat it as part of the same cluster as the other openBI upload findings and fix them together. The record states the exploit has been disclosed to the public. It does not state active exploitation, and the CISA Known Exploited Vulnerabilities flag is false for this CVE.
Quick check
Is there a patched version of openBI?
The record names none. It only says versions up to 1.0.8 are affected. Check the project and the VulDB entry for the current state before relying on any version.
Is this exploited in the wild?
The record says an exploit has been disclosed publicly. It is not on the CISA KEV list, and no source I read reports active attacks.
Sources
Last reviewed: 19 October 2026.
