PT-2023-2238 · Hitachi Vantara · Pentaho Business Analytics Server

Published 2023-04-03 · Updated 2025-10-08 · CVE-2022-43939

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x

Description The issue is related to the use of non-canonical URL paths for authorization solutions, which can be circumvented. This can allow a remote attacker to elevate their privileges. The vulnerability is being actively exploited.

Recommendations For versions before 9.4.0.1 and 9.3.0.2, including 8.3.x, update to a version that contains the security fix, such as version 9.4.0.1 or 9.3.0.2, to prevent the exploitation of this issue. As a temporary workaround, consider restricting access to non-canonical URLs to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-647

Related Identifiers

BDU:2023-01993

CVE-2022-43939

Affected Products

Pentaho Business Analytics Server

References · 24

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/pentaho_business_server_authbypass_and_ssti.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/51350 · Exploit
• https://osv.dev/vulnerability/CVE-2022-43939 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01993 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-43939 · Security Note
• https://reddit.com/r/pwnhub/comments/1j2rbqo/cisa_warns_of_newly_exploited_vulnerabilities · Reddit Post
• https://t.me/cvenotify/113284 · Telegram Post
• https://reddit.com/r/cybersecurity/comments/1j3505q/cisa_sounds_alarm_cisco_microsoft_hitachi_flaws · Reddit Post
• https://twitter.com/transilienceai/status/1898342193556799668 · Twitter Post
• https://twitter.com/ScyScan/status/1896955895525093651 · Twitter Post
• https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-BA-Server-Use-of-Non-Canonical-URL-Paths-for-Authorization-Decisions-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43939- · Security Note, Vendor Advisory
• https://twitter.com/transilienceai/status/1898704640553738415 · Twitter Post
• https://twitter.com/UndercodeNews/status/1896898821344616641 · Twitter Post
• https://t.me/cybersecuritytechnologies/8078 · Telegram Post