CVE-2023-3517: Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-12 · updated 2026-06-17
Weakness: CWE-99

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.

Affected products

Hitachi Pentaho Data Integration And Analytics: from 1.0 before 9.3.0.5; from 9.4.0.0 before 9.5.0.1 — fixed in 9.3.0.5, 9.5.0.1

How to fix

Upgrade to a fixed version: Hitachi Pentaho Data Integration And Analytics 9.3.0.5, 9.5.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-3517 or the next vulnerability affects your stack