Actively exploited in the wild

Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

Hitachi Vantara - Pentaho Business Analytics (BA) Server · Listed in the CISA KEV since 2025-03-03. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2022-43769

HighCVSS 8.8KEV

Published: 03/04/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x, allow certain web services to set property values which contain Spring templates that are interpreted downstream. This can lead to server-side template injection.

Risk Assessment

An attacker could exploit this vulnerability to execute arbitrary code or gain unauthorized access through injection of malicious Spring templates.

Recommendation

Update Hitachi Vantara Pentaho Business Analytics Server to version 9.4.0.1 or 9.3.0.2 (or later).

Other vulnerabilities in Hitachi Vantara Pentaho Business Analytics Server

CVE-2022-43939HighActively exploited
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x, contain security restrictions using non-canonical URLs which can be circumvented. The flaw allows bypassing these restrictions.

Original NVD description (English source)

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.