CVE-2024-5706

Summary

CVE-2024-5706 is a vulnerability affecting Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 10.2.0.0 and 9.3.0.9, including 8.3.x. This issue stems from the product's failure to restrict JNDI identifiers during the creation of Community Dashboards, leading to an unintended sphere of control (CWE-99). An attacker can exploit this flaw to gain access to or modify sensitive data or system resources, potentially allowing unauthorized users to execute remote code. The vulnerability puts protected files or directories, including configuration files and sensitive information, at risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.