CVE-2024-1114 is a medium-severity flaw in openBI, a business intelligence web application, with a CVSS score of 6.5. The record says versions up to 1.0.8 are affected and names no fixed release. Until you can confirm a patched build, treat internet exposure as the risk to remove first.
What's affected
The record lists openBI up to and including 1.0.8 as affected. The problem sits in the function dlfile of /application/index/controller/Screen.php, through the fileUrl argument. The record scores it 6.5.
The record names no fixed version, and the VulDB entry (VDB-252472) could not be read when I tried to fetch it. Check the openBI project directly for a patched release before you assume one exists.
How to check if you're exposed
Start with an inventory. Find every host that runs openBI and read the version from its install directory or deployment notes. Anything at or below 1.0.8 is in scope.
If you track dependencies and deployments in a repository, the free in-browser dependency scan will show whether openBI or a fork of it appears in your manifests. For a running server, look at your web access logs for requests to the path /application/index/controller/Screen.php from addresses you do not recognise. The advisory sources do not publish a fixed detection method, so treat log review as a hint and not a verdict.
What to do now
- Find every openBI instance and record its version and who can reach it.
- Check the project page and the VulDB entry for a fixed release. If none is published, plan to replace or retire the product.
- Take the instance off the public internet. Put it behind a VPN or an IP allow list while you decide.
- Review web server logs for the affected path and for unexpected changes on disk since the instance went live.
- Review what the server user can read on disk and tighten it, so a download function cannot reach secrets.
- Add the product to your watch list so a later fix or follow up CVE reaches you quickly.
Why it matters
The weakness class is CWE-284 (improper access control). Improper access control means the function hands over something a caller should not be allowed to reach. The record does not say exactly what is exposed, so do not assume it is limited to harmless files.
A download function that trusts a caller supplied location is a common source of data exposure. Check what credentials and config files sit where the web user can read them. The record states the exploit has been disclosed to the public. It does not state active exploitation, and the CISA Known Exploited Vulnerabilities flag is false for this CVE.
Quick check
Is there a patched version of openBI?
The record names none. It only says versions up to 1.0.8 are affected. Check the project and the VulDB entry for the current state before relying on any version.
Is this exploited in the wild?
The record says an exploit has been disclosed publicly. It is not on the CISA KEV list, and no source I read reports active attacks.
Sources
Last reviewed: 19 October 2026.
