CVE-2023-3517: Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')
Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3517?
CVE-2023-3517 is rated as a medium severity vulnerability.
How do I fix CVE-2023-3517?
To fix CVE-2023-3517, upgrade your Hitachi Vantara Pentaho Data Integration & Analytics to version 9.5.0.1 or 9.3.0.5 or later.
Which versions are affected by CVE-2023-3517?
CVE-2023-3517 affects Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 9.5.0.1 and 9.3.0.5, including all 8.3.x versions.
What type of vulnerability is CVE-2023-3517?
CVE-2023-3517 is a JNDI injection vulnerability that allows unauthorized control of system level data sources.
What can happen if CVE-2023-3517 is exploited?
If CVE-2023-3517 is exploited, an attacker could gain unauthorized access to sensitive data sources through JNDI identifiers.