CVE-2022-43769: Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
Vulnerability summary
CVE-2022-43769 is a high (CVSS 8.8) Injection vulnerability in Hitachi Vantara Pentaho Business Analytics (BA) Server. It is known to be exploited: CISA lists it, first on 03-03-2025. EPSS estimates a 97.67% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 03-04-2023PublishedVulnerability first disclosed.
- 03-03-2025Added to CISA KEVHitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
- 24-03-2025CISA remediation dueApply mitigations per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
97.67%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 97.67% on 20-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-03-2025
- Federal due date
- 24-03-2025
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. support.pentaho.com/hc/… nvd.nist.gov/vuln/detail/CVE-2022-43769
Public exploits
3 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)
Maturity: poc
Pentaho Business Server Auth Bypass and Server Side Template Injection RCE
exploit/multi/http/pentaho_business_server_authbypass_and_ssti
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Affected systems
Hitachi1 product
- vantara_pentaho_business_analytics_server≥ 8.3.0.0, < 9.3.0.2 | 9.4.0.0
Hitachi vantara1 product
- pentaho business analytics server≥ 1.0, < 9.3.0.2 | ≥ 9.4.0.0, < 9.4.0.1
2 vendors · 2 products
References
3 links- support.pentaho.com/hc/…Vendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-43769Government ResourceUS Government Resource