PT-2023-25181 · Hitachi Vantara · Pentaho Data Integration & Analytics

Markus Wulftange · Publicado 2023-12-12 · Atualizado 2023-12-18 · CVE-2023-3517

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 9.5.0.1 Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 9.3.0.5 Hitachi Vantara Pentaho Data Integration & Analytics version 8.3.x

Description The issue allows control of system level data sources due to the lack of restriction on JNDI identifiers during the creation of XActions.

Recommendations For versions prior to 9.5.0.1, update to version 9.5.0.1 or later. For versions prior to 9.3.0.5, update to version 9.3.0.5 or later. For version 8.3.x, consider restricting the creation of XActions or disabling the feature until a patch is available.

Correção

Enumeração de Fraquezas

CWE-99

Identificadores relacionados

CVE-2023-3517

Produtos afetados

Pentaho Data Integration & Analytics

Referências · 6

• https://t.me/cvenotify/63368 · Publicação no Telegram
• https://support.pentaho.com/hc/en-us/articles/19668665099533 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-3517 · Nota de Segurança
• https://twitter.com/CVEnew/status/1734704982610321770 · Publicação no Twitter
• https://t.me/cvenotify/63936 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-3517 · Aviso do Fabricante