HIGH🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2022-43939

CVSS 8.6v3.1pub. 2023-04-03upd. 2025-10-24

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

  • Hitachi Vantara Pentaho Business Analytics Server

    APP
    Hitachi
    9.4.0.0< 9.3.0.2

CISA KEV — detailsi

Vendori
Hitachi Vantara
Producti
Pentaho Business Analytics (BA) Server
Added to KEVi
March 3, 2025
Remediation deadline (US Federal)i
March 24, 2025(overdue)
Required action (CISA)i

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 24 marca 2025
CWE
References

Related vulnerabilities

CVE-2022-43769HIGH8.8⚠ KEVten sam produkt

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow...

CVE-2022-4815HIGH8.0ten sam produkt

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deseri...

CVE-2022-43940HIGH8.8ten sam produkt

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not...

CVE-2022-43773HIGH8.8ten sam produkt

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is i...

CVE-2022-43938HIGH8.8ten sam produkt

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cann...