Vulnerability Description
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hitachi | Vantara Pentaho Business Analytics Server | >= 8.3.0.0, < 9.3.0.2 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-AuthenticatiExploit
- https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BVendor Advisory
- http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-AuthenticatiExploit
- https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-US Government Resource
FAQ
What is CVE-2022-43769?
CVE-2022-43769 is a vulnerability with a CVSS score of 8.8 (HIGH). Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are inter...
How severe is CVE-2022-43769?
CVE-2022-43769 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-43769?
Check the references section above for vendor advisories and patch information. Affected products include: Hitachi Vantara Pentaho Business Analytics Server.