CVE-2023-3517 (published 2023-12-12T22:28:08.559Z)

Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 
8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.


Affected products: Vendor: Hitachi Vantara
Product: Pentaho Data Integration & Analytics
Versions: 1.0, 9.4.0.0