Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

CVE-2022-43938

Summary

Hitachi Vantara's Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x, exposes a critical weakness where system administrators are unable to disable the scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager. This vulnerability can lead to static code injection risks, as unauthorized scripts may be executed, potentially compromising the integrity and security of data handled by the analytics server.

References