CVE-2024-57971

Summary

CVE-2024-57971 is a vulnerability affecting the SpagoBI API support in Knowage Server before version 8.1.30. The issue lies in DataSourceResource.java, where JNDI Names used to specify database connections do not have to begin with "java:comp/env/jdbc/". This lack of validation may result in unauthorized access to sensitive database information. An attacker could exploit this flaw by injecting malicious JNDI Names and gain unauthorized access to the underlying database. This vulnerability poses a significant risk as it may allow an attacker to bypass critical security controls and potentially steal confidential data.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.