Design/Logic Flaw

2023-12-1223:15:00

PRIOn knowledge base

www.prio-n.com

hitachi vantara

pentaho

data integration

analytics

jndi

system data source

7.3 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

19.5%

JSON

Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including
8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.

CPENameOperatorVersion
pentaho_data_integration_and_analyticsge9.4.0.0
pentaho_data_integration_and_analyticslt9.5.0.1
pentaho_data_integration_and_analyticsge1.0
pentaho_data_integration_and_analyticslt9.3.0.5

Name	Operator	Version
pentaho_data_integration_and_analytics	ge	9.4.0.0
pentaho_data_integration_and_analytics	lt	9.5.0.1
pentaho_data_integration_and_analytics	ge	1.0
pentaho_data_integration_and_analytics	lt	9.3.0.5

References

support.pentaho.com/hc/en-us/articles/19668665099533