HIGH🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2022-43769

CVSS 8.8v3.1pub. 2023-04-03upd. 2025-10-24

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Hitachi Vantara Pentaho Business Analytics Server

    APP
    Hitachi
    9.4.0.08.3.0.0 – 9.3.0.2 (bez)

CISA KEV — detailsi

Vendori
Hitachi Vantara
Producti
Pentaho Business Analytics (BA) Server
Added to KEVi
March 3, 2025
Remediation deadline (US Federal)i
March 24, 2025(overdue)
Required action (CISA)i

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 24 marca 2025
CWE
References

Related vulnerabilities

CVE-2022-43939HIGH8.6⚠ KEVten sam produkt

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain...

CVE-2022-4815HIGH8.0ten sam produkt

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deseri...

CVE-2022-43940HIGH8.8ten sam produkt

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not...

CVE-2022-43938HIGH8.8ten sam produkt

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cann...

CVE-2022-43773HIGH8.8ten sam produkt

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is i...