Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

CVE-2022-43769

Summary

The affected versions of Hitachi Vantara Pentaho Business Analytics Server allow certain web services to accept and set property values that contain Spring templates. These templates, if not properly sanitized, may be interpreted downstream, leading to possible content injection and exploitation scenarios. Attackers could leverage this vulnerability to potentially execute arbitrary code or gain unauthorized access to system resources.

References