CVE-2022-43769

Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

Affected

Hitachi Vantara · Pentaho Business Analytics Server

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 HITACHIVANTARA

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

97.67% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2025-03-03

Nuclei

high

Published

2023-04-03

Updated

2025-10-21

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43769.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/pentaho_business_serv…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51350

Security advisories

• https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-…

References

• CVE Record
• NVD entry