CVE-2022-43939

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - security.vulnerabilities@hitachivantara.com

Published

2023-04-03

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2025-03-03, action due 2025-03-24: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

CWE-647

Affected products

• Vantara Pentaho Business Analytics Server (Hitachi)
• Pentaho Business Analytics Server (Hitachi Vantara)

References

• http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html
• https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-BA-Server-Use-of-Non-Canonical-URL-Paths…
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-43939