Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')

CVE-2023-3517

What is CVE-2023-3517?

The vulnerability in Hitachi Vantara Pentaho Data Integration & Analytics arises from the lack of restrictions on JNDI identifiers during XActions creation. This flaw can lead to unauthorized manipulation of system-level data sources, potentially allowing attackers to gain access to sensitive information or disrupt data integration processes. Users are advised to upgrade to the secure versions to mitigate potential risks.

References