Actively exploited · Published Apr 3, 2023 · Assigned by HITVAN
CVE-2022-43939Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions
High 8.6 Exploited
In plain English
A high-severity security flaw in Pentaho Business Analytics Server from Hitachi Vantara. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2025). The chance it is exploited in the next 30 days is estimated at 92.3% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Mar 24, 2025.
Official description
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hitachi Vantara | Pentaho Business Analytics Server | 1.0 – before 9.3.0.29.4.0.0 – before 9.4.0.1 |
Weakness: CWE-647 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
References
- https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-BA-Server-Use-of-Non-Canonical-URL-Paths-for-Authorization-Decisions-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43939-
- http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-43939 government-resource