CVE-2023-3517

Published: Dec 12, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.

Affected (2)

Products: Hitachi: Pentaho Data Integration And Analytics

Hitachi

1 product

Pentaho Data Integration And Analytics

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Hitachi Pentaho Data Integration And Analytics	From 1.0 to 9.3.0.5
Hitachi Pentaho Data Integration And Analytics	From 9.4.0.0 to 9.5.0.1

Related CWEs

CWE-99

Improper Control of Resource Identifiers ('Resource Injection')

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

References (2)

https://support.pentaho.com/hc/en-us/articles/19668665099533

Source: security.vulnerabilities@hitachivantara.com

Vendor Advisory

https://support.pentaho.com/hc/en-us/articles/19668665099533

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.