← Vulnerability feed

Vulnerability record · CVE-2022-43771 · published 3 April 2023

CVE-2022-43771: Hitachi vantara pentaho business analytics server path traversal vulnerability

Hitachi · Vantara Pentaho Business Analytics Server

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds.  

6.5 CVSS 3.1 Medium EPSS 24% · top 2.2% CWE-22 · Path traversal
6.5CVSS 3.1 base score
24%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds.  

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.pentaho.com/hc/en-us/articles/14455007818509--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server Vendor Advisory
https://support.pentaho.com/hc/en-us/articles/14455007818509--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server Vendor Advisory

Track CVE-2022-43771 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-43939Pentaho Business Analytics Server authorization bypass via non-canonical URLsHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x, makes authorization decisions using non-canon…KEVEPSS 92%analysed7.2CVE-2022-43769Hitachi Vantara Pentaho BA Server Spring Template InjectionHitachi Vantara Pentaho Business Analytics Server before 9.4.0.1 and 9.3.0.2, including 8.3.x, allows certain web services to set property values con…KEVEPSS 98%analysed8.8CVE-2022-4815Hitachi vantara pentaho deserialization of untrusted data vulnerabilityHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constr…EPSS 0.63%8.8CVE-2022-43938Hitachi vantara pentaho business analytics server code injection vulnerabilityHitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disab…EPSS 26%8.8CVE-2022-43940Hitachi vantara pentaho business analytics server incorrect authorization vulnerabilityHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization chec…EPSS 0.56%8.8CVE-2022-43773Hitachi vantara pentaho business analytics server incorrect permission assignment vulnerabilityHitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data sourc…EPSS 22%6.5CVE-2022-43941Hitachi vantara pentaho business analytics server xml external entity (xxe) vulnerabilityHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis ser…EPSS 0.53%6.5CVE-2022-43772Hitachi vantara pentaho business analytics server sensitive information in log file vulnerabilityHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username a…EPSS 0.39%

Source: NIST National Vulnerability Database (record CVE-2022-43771), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.