Resource Injection Vulnerability in Hitachi Vantara Pentaho Data Integration & Analytics

CVE-2025-0756

Summary

The Hitachi Vantara Pentaho Data Integration & Analytics product has a vulnerability that stems from improper restrictions on the control of JNDI identifiers. This flaw allows an attacker to manipulate input during the creation of platform data sources, potentially leading to unauthorized access or modification of sensitive data and system resources. Exploiting this vulnerability may grant an attacker access to protected files—including configuration files—which could result in remote code execution.

References