CVE-2022-43769: Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: yes — in CISA KEV since 2025-03-03
EPSS: 97.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-04-03 · updated 2026-06-17
Weakness: CWE-74

Description

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

Affected products

Hitachi Vantara Pentaho Business Analytics Server: from 8.3.0.0 before 9.3.0.2; 9.4.0.0 — fixed in 9.3.0.2

How to fix

Upgrade to a fixed version: Hitachi Vantara Pentaho Business Analytics Server 9.3.0.2. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html
https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769-
http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html
https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769-
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-43769

Get alerted when CVE-2022-43769 or the next vulnerability affects your stack