CVE-2022-43939highunder attackCWE-647

CVE-2022-43939: high-severity vulnerability in Hitachi Vantara Pentaho Business Analytics…

Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions

Published · Updated

Follow this CVE+ Monitor Pentaho Business Analytics Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.6epss 92%
from disclosure to weapon1 day
Published on NVDApr 3
1st PoC+1d
metasploit+1d
CISA KEV+700d
Action required by CISAfederal deadline: 2025-03-24

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Pentaho Business Analytics Server uses improperly formatted URLs to check permissions, allowing attackers to bypass security restrictions by using alternative URL patterns. This can give unauthorized access to sensitive features or data.

Technical detail

The application enforces authorization checks based on non-canonical URL paths, which can be circumvented by submitting requests with alternative URL encodings or path traversal patterns. An attacker with network access can craft malicious requests to bypass access controls and reach restricted resources or functionalities, affecting versions before 9.4.0.1 and 9.3.0.2.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Affected products
Hitachi Vantara · Pentaho Business Analytics Server
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Hitachi Vantara Pentaho Business Analytics…

In the same product, most dangerous first.

CVE-2022-43769HIGHHitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)EPSS 97.7%KEVCVE-2022-43938HIGHHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') EPSS 26.4%CVE-2022-43771MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') EPSS 23.9%CVE-2022-43773HIGHHitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource EPSS 22.2%CVE-2024-5706HIGHHitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')EPSS 0.7%CVE-2021-45448HIGHPentaho Business Analytics Server - Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user supplied path to access resources that are out of bounds.EPSS 0.7%