Vulnerability Description
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
CVSS Score
8.6
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hitachi | Vantara Pentaho Business Analytics Server | < 9.3.0.2 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-AuthenticatiExploit
- https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-BVendor Advisory
- http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-AuthenticatiExploit
- https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-BVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-US Government Resource
FAQ
What is CVE-2022-43939?
CVE-2022-43939 is a vulnerability with a CVSS score of 8.6 (HIGH). Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
How severe is CVE-2022-43939?
CVE-2022-43939 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-43939?
Check the references section above for vendor advisories and patch information. Affected products include: Hitachi Vantara Pentaho Business Analytics Server.