Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

CVE-2022-43769

8.8HIGH

Key Information

Vendor: Hitachi
Status: Pentaho Business Analytics Server
Vendor: CVE Published:; 3 April 2023

Summary

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

Affected Version(s)

Pentaho Business Analytics Server < 9.3.0.2

Pentaho Business Analytics Server < 9.4.0.1

EPSS Score

40% chance of being exploited in the next 30 days.

CVSS V3.1

Score:

8.8

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Risk change from: 7.2 to: 8.8 - (HIGH)
Aug 3, 2024
Vulnerability published.
Apr 3, 2023
Vulnerability Reserved.
Oct 26, 2022

Collectors

NVD DatabaseMitre Database

Credit

Harry Withington, Aura Information Security