CVE-2022-43769highunder attackCWE-74

CVE-2022-43769: high-severity vulnerability in Hitachi Vantara Pentaho Business Analytics…

Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Published · Updated

Follow this CVE+ Monitor Pentaho Business Analytics Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 98%
from disclosure to weapon1 day
Published on NVDApr 3
1st PoC+1d
metasploit+1d
CISA KEV+700d
Action required by CISAfederal deadline: 2025-03-24

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Pentaho Business Analytics Server allows attackers to inject Spring template code through web service properties, which gets executed later. This lets them run arbitrary code on the server.

Technical detail

CWE-74 (Special Element Injection) vulnerability in Pentaho web services fails to sanitize Spring template expressions in property values before interpretation. Unauthenticated or authenticated attackers can inject malicious templates through affected web service endpoints; downstream processing interprets these templates, leading to remote code execution with server privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Hitachi Vantara · Pentaho Business Analytics Server
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Hitachi Vantara Pentaho Business Analytics…

In the same product, most dangerous first.

CVE-2022-43939HIGHHitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization DecisionsEPSS 92.3%KEVCVE-2022-43938HIGHHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') EPSS 26.4%CVE-2022-43771MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') EPSS 23.9%CVE-2022-43773HIGHHitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource EPSS 22.2%CVE-2024-5706HIGHHitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')EPSS 0.7%CVE-2021-45448HIGHPentaho Business Analytics Server - Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user supplied path to access resources that are out of bounds.EPSS 0.7%