PT-2023-25181 · Hitachi Vantara · Pentaho Data Integration & Analytics

Markus Wulftange · Published 2023-12-12 · Updated 2023-12-18 · CVE-2023-3517

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 9.5.0.1 Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 9.3.0.5 Hitachi Vantara Pentaho Data Integration & Analytics version 8.3.x

Description The issue allows control of system level data sources due to the lack of restriction on JNDI identifiers during the creation of XActions.

Recommendations For versions prior to 9.5.0.1, update to version 9.5.0.1 or later. For versions prior to 9.3.0.5, update to version 9.3.0.5 or later. For version 8.3.x, consider restricting the creation of XActions or disabling the feature until a patch is available.

Fix

Weakness Enumeration

CWE-99

Related Identifiers

CVE-2023-3517

Affected Products

Pentaho Data Integration & Analytics

References · 6

• https://support.pentaho.com/hc/en-us/articles/19668665099533 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3517 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3517 · Vendor Advisory
• https://t.me/cvenotify/63368 · Telegram Post
• https://twitter.com/CVEnew/status/1734704982610321770 · Twitter Post
• https://t.me/cvenotify/63936 · Telegram Post