CVE-2022-43769

KEV

Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

Vendor / Project: Hitachi Vantara
Product: Pentaho Business Analytics (BA) Server
Date added: Mar 3, 2025
Due date: Mar 24, 2025
Known ransomware use: Unknown
CWEs: CWE-74

Description

Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769
https://nvd.nist.gov/vuln/detail/CVE-2022-43769