Improper Control of Resource Identifiers in Hitachi Vantara Pentaho Data Integration & Analytics

CVE-2024-5706

Summary

The vulnerability in Hitachi Vantara Pentaho Data Integration & Analytics is due to insufficient controls on JNDI identifiers when creating Community Dashboards. This lack of restrictions can allow attackers to manipulate how system-level data sources are accessed. An attacker could potentially gain unauthorized access to sensitive data and system resources, leading to the possibility of accessing protected files, including configuration files containing sensitive information. Ultimately, this flaw could enable remote code execution by unauthorized individuals, posing a significant threat to data integrity and security.

References