Hitachi Vantara Pentaho Data Integration & Analytics JNDI Resource Injection Vulnerability

A vulnerability exists in Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 10.2.0.0 and 9.3.0.9, including 8.3.x. The issue arises from improper validation of JNDI identifiers when creating Community Dashboards, allowing unauthorized control over system-level data sources. This could enable access to or modification of sensitive data or system resources, potentially leading to remote code execution by unauthorized users.

Impact

Exploitation of this vulnerability could allow unauthorized users to access or modify sensitive data and system resources, including protected files and directories containing configuration details and other sensitive information. Such access could facilitate remote code execution.

Remediation

Users can upgrade to Hitachi Vantara Pentaho Data Integration & Analytics version 10.2.0.0 or 9.3.0.9 to address this vulnerability.