CVE-2023-5617

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a server error is encountered.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-550CWE-209

Affected software

No affected versions have been published.

Timeline

Published
Feb 28, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-56185.4The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and incCVE-2023-56205.4The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of the plugin options, soCVE-2023-56214.8The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions uCVE-2023-56228.8Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORITY\SYSTEM on Windows CVE-2023-56237.8NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM priCVE-2023-56247.2Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This could allow an admin user to alterCVE-2023-56257.5A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch CVE-2023-56268.8Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.CVE-2023-56277.5A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from theCVE-2023-56296.1A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phishiCVE-2023-56304.9A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmwareCVE-2023-56315.4Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document