Actively exploited in the wild

Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability

Hitachi Vantara - Pentaho Business Analytics (BA) Server · Listed in the CISA KEV since 2025-03-03. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2022-43939

HighCVSS 8.6KEV

Published: 03/04/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x, contain security restrictions using non-canonical URLs which can be circumvented. The flaw allows bypassing these restrictions.

Risk Assessment

An attacker could bypass security mechanisms, potentially leading to unauthorized access to protected resources or server functions.

Recommendation

Update Hitachi Vantara Pentaho Business Analytics Server to version 9.4.0.1 or 9.3.0.2 (or later).

Other vulnerabilities in Hitachi Vantara Pentaho Business Analytics Server

CVE-2022-43769HighActively exploited
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x, allow certain web services to set property values which contain Spring templates that are interpreted downstream. This can lead to server-side template injection.

Original NVD description (English source)

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.