Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-3517

Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.

Published

2023-12-12T23:15:07.003

Last Modified

2024-11-21T08:17:26.280

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.5 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-99
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application hitachi pentaho_data_integration_and_analytics < 9.3.0.5 Yes
Application hitachi pentaho_data_integration_and_analytics < 9.5.0.1 Yes
References