{"id":"CVE-2023-3517","aliases":["EUVD-2023-44175","GHSA-5w65-7gfr-vxjf"],"status":"published","title":"Hitachi Vantara Pentaho Data Integration \u0026 Analytics - Improper Control of Resource Identifiers  ('Resource Injection')","description":"Hitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 9.5.0.1 and 9.3.0.5, including \n8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.","severity":{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00642,"percentile":0.51091,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-99"],"published":"2023-12-12T22:28:08Z","modified":"2026-06-17T06:14:15Z","products":[{"vendor":"hitachi","product":"pentaho_data_integration_and_analytics"},{"vendor":"hitachi vantara","product":"pentaho data integration \u0026 analytics"}],"references":[{"url":"https://support.pentaho.com/hc/en-us/articles/19668665099533","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3517"},{"url":"https://github.com/advisories/GHSA-5w65-7gfr-vxjf"}],"sources":{"cve":[{"id":"CVE-2023-3517","title":"Hitachi Vantara Pentaho Data Integration \u0026 Analytics - Improper Control of Resource Identifiers  ('Resource Injection')","description":"\nHitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 9.5.0.1 and 9.3.0.5, including \n8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.\n\n","status":"published","published":"2023-12-12T22:28:08.559Z","modified":"2024-08-02T06:55:03.685Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-99"],"updated_at":"2026-11-02T14:35:24.707957Z"}],"euvd":[{"id":"EUVD-2023-44175","description":"\nHitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 9.5.0.1 and 9.3.0.5, including \n8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.\n\n","status":"published","published":"2023-12-12T22:28:08Z","modified":"2024-08-02T06:55:03Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:50:13.100319Z"}],"ghsa":[{"id":"GHSA-5w65-7gfr-vxjf","title":"\nHitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 9.5.0.1 and 9.3.0.5,...","description":"\nHitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 9.5.0.1 and 9.3.0.5, including \n8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.\n\n","status":"published","published":"2023-12-13T00:30:37Z","modified":"2023-12-13T00:30:43Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-99"],"updated_at":"2026-11-02T14:55:11.44614Z"}],"nvd":[{"id":"CVE-2023-3517","description":"\nHitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 9.5.0.1 and 9.3.0.5, including \n8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.\n\n","status":"published","published":"2023-12-12T23:15:07.003Z","modified":"2026-06-17T06:14:15.53Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-99"],"updated_at":"2026-11-02T14:08:54.696438Z"}]}}