← CVE Radar
CVE-2022-43939Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
9.8 CRITICALEPSS 92.26%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 8.6 | HIGH | 3.1HITVAN (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
CISA required action
⚡ Known exploited · remediation due Mar 24, 2025
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2022-43939
- Status
- Analyzed
- Assigner (CNA)
- HITVAN
- Published
- Apr 3, 2023
- Last modified
- 2026-06-17 05:07 UTC
- Weaknesses
- CWE-647 · Use of Non-Canonical URL Paths for Authorization Decisions
Affected Products
As published by the CNA in the CVE record.
Hitachi VantaraPentaho Business Analytics Server2 version ranges
- 1.0 before 9.3.0.2
- 9.4.0.0 before 9.4.0.1
References
- packetstormsecurity.com http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html
- support.pentaho.com https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-BA-Server-Use-of-Non-Canonical-URL-Paths-for-Authorization-Decisions-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43939-
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-43939