PT-2025-7446 · Hitachi Vantara · Pentaho Data Integration & Analytics

Published 2024-06-06 · Updated 2025-02-21 · CVE-2024-5706

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 10.2.0.0 and 9.3.0.9, including 8.3.x

Description The product receives input from an upstream component but does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. This could allow an attacker to gain access to or modify sensitive data or system resources, potentially leading to remote code execution by unauthorized users.

Recommendations For versions prior to 10.2.0.0 and 9.3.0.9, including 8.3.x, update to version 10.2.0.0 or 9.3.0.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the JNDI identifiers during the creation of Community Dashboards to minimize the risk of exploitation. Restrict access to sensitive data and system resources to prevent unauthorized access or modification.

Fix

RCE

Weakness Enumeration

CWE-99

Related Identifiers

BDU:2025-02159

CVE-2024-5706

Affected Products

Pentaho Data Integration & Analytics

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-5706 · Security Note
• https://bdu.fstec.ru/vul/2025-02159 · Security Note
• https://vuldb.com/?id.296319 · Note
• https://twitter.com/cybercronai/status/1892771598966444412 · Twitter Post
• https://twitter.com/CveFindCom/status/1892348856345477491 · Twitter Post
• https://twitter.com/CVEnew/status/1892351841075142785 · Twitter Post
• https://support.pentaho.com/hc/en-us/articles/34296195570189--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Improper-Control-of-Resource-Identifiers-Resource-Injection-Versions-before-10-2-0-0-and-9-3-0-9-including-8-3-x-Impacted-CVE-2024-5706 · Note