Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference

CVE-2022-43941

What is CVE-2022-43941?

The Hitachi Vantara Pentaho Business Analytics Server suffers from a vulnerability that fails to adequately safeguard the Post Analysis service endpoint of its data access plugin. This flaw allows attackers to exploit XML External Entity (XXE) references, potentially leading to exposure of sensitive data or system compromise. Users are urged to upgrade to versions 9.4.0.1, 9.3.0.2 or later to mitigate this security risk.

References