CVE-2022-43939
Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability
Published Apr 3, 2023 · updated Jun 16, 2026 · hitachi vantara pentaho business analytics server
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
Timeline
Detection, updates, and resolution for this record.
Apr 3, 2023 · Catalog
Detected
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
Mar 3, 2025 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Mar 24, 2025 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Mar 24, 2025
Affected
- cpe hitachi/vantara pentaho business analytics serverversion unspecified
- cpe hitachi/vantara pentaho business analytics server9.4.0.0
- vendor Hitachi Vantara Pentaho Business Analytics (BA) Serverversion unspecified
Sources
- CISA KEVCVE-2022-43939
Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization.
cisa.gov - CVE.orgCVE-2022-43939
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-43939
30-day exploitation probability 92.3%
first.org - Exploit Database51350
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_multi/http/pentaho_business_server_authbypass_and_ssti
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2022-43939
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com