// For flags

CVE-2024-5706

Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99) Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not restrict JNDI identifiers during the creation of Community Dashboards, allowing control of system-level data sources. An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information, which can lead to remote code execution by unauthorized users.

*Credits: tuo4n8 & thongvv (GE) from VNG Security Response Center
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-06-06 CVE Reserved
  • 2025-02-19 CVE Published
  • 2025-02-20 CVE Updated
  • 2025-02-20 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-99: Improper Control of Resource Identifiers ('Resource Injection')
CAPEC
  • CAPEC-240: Resource Injection
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Hitachi Vantara
Search vendor "Hitachi Vantara"
 Pentaho Data Integration & Analytics
Search vendor "Hitachi Vantara" for product "Pentaho Data Integration & Analytics"
 >= 10.0.0.0 < 10.2.0.0
Search vendor "Hitachi Vantara" for product "Pentaho Data Integration & Analytics" and version " >= 10.0.0.0 < 10.2.0.0"
en
Affected
Hitachi Vantara
Search vendor "Hitachi Vantara"
 Pentaho Business Analytics Server
Search vendor "Hitachi Vantara" for product "Pentaho Business Analytics Server"
 >= 1.0.0.0 < 9.3.0.9
Search vendor "Hitachi Vantara" for product "Pentaho Business Analytics Server" and version " >= 1.0.0.0 < 9.3.0.9"
en
Affected