CVE-2022-43769

🔥 Known Exploited (CISA KEV)HIGH

8.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2023-04-03

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

Affected Platforms (CPE)

📦

Hitachi

Vantara Pentaho Business Analytics Server

>= 8.3.0.0 and < 9.3.0.2= 9.4.0.0

References & Advisories

🔗 http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html

🔗 https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769-

🔗 http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-43769

Vulnerability Description

Affected Platforms (CPE)

Vantara Pentaho Business Analytics Server

References & Advisories

Related Vulnerabilities