CVE-2022-43938: hitachi vantara pentaho business analytics server Static Code Injection

Vulnerability summary

CVE-2022-43938 is a high (CVSS 8.8) Static Code Injection vulnerability in hitachi vantara pentaho business analytics server. EPSS estimates a 26.44% chance of exploitation in the next 30 days, higher than 97.9% of scored vulnerabilities.

Timeline

1. 03-04-2023
   PublishedVulnerability first disclosed.
2. 11-02-2025
   Last modifiedVulnerability information updated.

Description

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager.

• CWE-96Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.
• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.