CVE-2024-5706
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-5706 is a high-severity Resource Injection (CWE-99) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 50% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-5706 is a resource injection vulnerability (CWE-99) in Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.0 and 9.3.0.9, including the 8.3.x series. The issue arises because the software receives input from an upstream component without properly restricting it before using it as an identifier for resources outside its intended control. Specifically, it fails to restrict JNDI identifiers during the creation of Community Dashboards, enabling attackers to control system-level data sources.
An attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), achieving high confidentiality, integrity, and availability impacts (CVSS 8.8). This allows unauthorized access to or modification of sensitive data and system resources, including protected files and directories such as configuration files containing sensitive information, potentially leading to remote code execution.
The official advisory from Hitachi Vantara Pentaho support indicates that the vulnerability has been resolved in versions 10.2.0.0 and 9.3.0.9. Security practitioners should apply these patches to mitigate the risk, as affected versions remain vulnerable to exploitation by low-privileged users.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4644
Vulnerability Data
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99) Hitachi Vantara…
more
Pentaho Data Integration & Analytics versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not restrict JNDI identifiers during the creation of Community Dashboards, allowing control of system-level data sources. An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information, which can lead to remote code execution by unauthorized users.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.3.8V1.3.9V1.3.11V9.2.2
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of inputs before they are accepted as resource identifiers.
Enforces authorizations on resource access so an injected identifier cannot reach outside the intended sphere.
Enforces information flow rules that block use of untrusted identifiers to reach unauthorized resources.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and sanitization that prevent resource-identifier injection flaws.
Least-privilege access policy and enforcement limits damage from injected resource identifiers even when input validation is absent.
Network segmentation and unauthorized-access controls reduce the blast radius of successful resource injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect resource-injection flaws but does not itself implement preventive controls.
Secure SDLC mandates input validation and resource-identifier sanitization that directly prevents resource injection.
Application security requirements explicitly call for controls on external identifiers used to access resources.
Secure architecture principles reduce attack surface for resource injection but do not prescribe identifier validation.
Secure coding standards require strict validation and whitelisting of all resource identifiers before use.
Information-access-restriction policies limit which resources can be referenced, indirectly reducing injection impact.