CVE-2023-3517

8.8 highEPSS 0.6%

High (8.8) in hitachi pentaho data integration and analytics. EPSS 0.6% chance of exploitation in the next 30 days.

Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE: CWE-99
Published: 2023-12-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

hitachi:pentaho_data_integration_and_analytics

References

https://support.pentaho.com/hc/en-us/articles/19668665099533
https://support.pentaho.com/hc/en-us/articles/19668665099533

Check your stack JSON