Cyber Resilience

CVE-2024-57971

Critical

Published: 16 February 2025

Published
16 February 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0003 10.9th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57971 is a critical-severity Resource Injection (CWE-99) vulnerability in Readthedocs (inferred from references). Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-57971 is a vulnerability in DataSourceResource.java within the SpagoBI API support of Knowage Server in KNOWAGE versions before 8.1.30. The flaw arises because the component fails to validate that JNDI names begin with "java:comp/env/jdbc/", allowing improper handling of resource identifiers (CWE-99). It has a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact network-accessible exploitation.

A high-privileged remote attacker (PR:H) can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables high confidentiality, integrity, and availability impacts across a changed scope (S:C), potentially allowing the attacker to manipulate JNDI lookups beyond intended data source contexts.

Mitigation is addressed in KNOWAGE version 8.1.30, as detailed in the GitHub commit f7d0362f737e1b0db1cc9cc95b1236d62d83dd0c and the release comparison between v8.1.29 and v8.1.30. Security practitioners should upgrade to the patched version and review JNDI configurations in affected deployments. Additional details are available in the Knowage documentation at spagobi.readthedocs.io.

EU & UK References

Vulnerability details

DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name.

CWE(s)
CWE-99

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

JNDI injection flaw in public SpagoBI API endpoint directly enables remote exploitation of a server-side application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-3693Shared CWE-99
CVE-2025-1642Shared CWE-99
CVE-2023-6605Shared CWE-99
CVE-2024-5706Shared CWE-99

Affected Assets

Readthedocs
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of JNDI names input to DataSourceResource.java to ensure they begin with 'java:comp/env/jdbc/', preventing improper resource identifier handling.

AC-3 Access Enforcement good match
prevent

Mandates enforcement of access authorizations for system resources, which this CVE bypasses through unvalidated JNDI lookups allowing access beyond intended data sources.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and correction of flaws like this JNDI validation failure, as fixed in KNOWAGE 8.1.30.

References