Critical severity · published Apr 3, 2023
CVE-2022-43939
Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions
In wildKEV
9.8
CVSS
92.3%
EPSS
Yes
On KEV
Description
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)92.3% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 3, 2025
Federal remediation dueMar 24, 2025
Ransomware campaign useNot known
Affected products
Which versions
PB
Pentaho Business Analytics Server · Hitachi Vantara
1.0 before 9.3.0.2; 9.4.0.0 before 9.4.0.1 · source: vendor
VP
Vantara Pentaho Business Analytics Server · Hitachi
before 9.3.0.2; 9.4.0.0 · source: NVD
PB
Pentaho Business Analytics (BA) Server · Hitachi Vantara
All versions, or not specified · source: KEV
Affected product
PB
Pentaho Business Analytics Server
Hitachi Vantara
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43939
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43939
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
support.pentaho.com
https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-BA-Server-Use-of-Non-Canonical-URL-Paths-for-Authorization-Decisions-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43939-
packetstormsecurity.com
http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html
More from Pentaho Business Analytics Server
7.2
CVE-2022-43769
Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
7.5
CVE-2021-45447
Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear text
7.5
CVE-2021-45446
Pentaho Business Analytics Server - Exposure of Information Through Directory Listing
6.5
CVE-2021-45448
Pentaho Business Analytics Server - Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user supplied path to access resources that are out of bounds.