CVE-2024-5706— Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')
Quick assessment
Affected
Hitachi Vantara Pentaho Data Integration & Analytics
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Hitachi Vantara Pentaho Data Integration & Analytics是日本日立制作所（Hitachi）公司的一个数据集成与分析系统。 Hitachi Vantara Pentaho Data Integration & Analytics存在安全漏洞，该漏洞源于未限制JNDI标识符，会导致敏感数据泄露。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-5706
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')
Source: CVE Program / CVE List V5
Vulnerability Description
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99)
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not restrict JNDI identifiers during the creation of Community Dashboards, allowing control of system-level data sources.
An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information, which can lead to remote code execution by unauthorized users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对资源描述符的控制不恰当(资源注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Hitachi Vantara Pentaho Data Integration & Analytics 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Hitachi Vantara Pentaho Data Integration & Analytics是日本日立制作所（Hitachi）公司的一个数据集成与分析系统。 Hitachi Vantara Pentaho Data Integration & Analytics存在安全漏洞，该漏洞源于未限制JNDI标识符，会导致敏感数据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Hitachi Vantara | Pentaho Data Integration & Analytics | 10.0 ~ 10.2.0.0 | - |
|
| Hitachi Vantara | Pentaho Business Analytics Server | 1.0 ~ 9.3.0.9 | - |
|
II. Public POCs for CVE-2024-5706
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-5706
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-5706 (1)
Same Patch Batch · Hitachi Vantara · 2025-02-19 · 9 CVEs total
| CVE-2024-37361 | 9.9 CRITICAL | Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data |
| CVE-2024-5705 | 8.8 HIGH | Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization |
| CVE-2024-37359 | 8.6 HIGH | Hitachi Vantara Pentaho Business Analytics Server – Server Side Request Forgery |
| CVE-2024-6697 | 6.5 MEDIUM | Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Perm |
| CVE-2024-37363 | 6.5 MEDIUM | Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization |
| CVE-2024-37362 | 6.3 MEDIUM | Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credential |
| CVE-2024-6696 | 4.9 MEDIUM | Hitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access Con |
| CVE-2024-37360 | 4.4 MEDIUM | Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input Durin |
IV. Related Vulnerabilities
Same product: Pentaho Data Integration & Analytics
-
CVE-2025-24907
Hitachi Vantara Pentaho Data Integration & Analytics – Path -
CVE-2025-24908
Hitachi Vantara Pentaho Data Integration & Analytics – Path -
CVE-2025-0756
Hitachi Vantara Pentaho Data Integration & Analytics - Impro -
CVE-2024-37363
Hitachi Vantara Pentaho Business Analytics Server - Incorrec -
CVE-2024-37362
Hitachi Vantara Pentaho Data Integration & Analytics - Insuf
Same vendor: Hitachi Vantara
-
CVE-2026-2253
Hitachi Vantara Pentaho Data Integration & Analytics - Impro -
CVE-2026-2255
Hitachi Vantara Pentaho Data Integration & Analytics - Insuf -
CVE-2026-2254
Hitachi Vantara Pentaho Data Integration & Analytics - Incor -
CVE-2025-11159
Hitachi Vantara Pentaho Data Integration & Analytics - Depen -
CVE-2025-11158
Hitachi Vantara Pentaho Data Integration & Analytics - Missi
Same weakness: CWE-99
-
CVE-2026-100884
Krayin laravel-crm attachment-download Endpoint acl.php reso -
CVE-2026-95847
Moquette client IDs can cause cross-session H2 durable-queue -
CVE-2026-94149
Omega Solution HRM OS Role Permission Retrieval Endpoint per -
CVE-2026-3855
Improper Control of Resource Identifiers ('Resource Injectio -
CVE-2026-81524
Cross-tenant database retargeting via dot/NUL injection in n
V. Comments for CVE-2024-5706
No comments yet