← Vulnerability feed

Vulnerability record · CVE-2022-43938 · published 3 April 2023

CVE-2022-43938: Hitachi vantara pentaho business analytics server code injection vulnerability

Hitachi · Vantara Pentaho Business Analytics Server

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager. 

8.8 CVSS 3.1 High EPSS 26% · top 2.1% CWE-96 · CWE-96CWE-94 · Code injection
8.8CVSS 3.1 base score
26%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager. 

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.pentaho.com/hc/en-us/articles/14454630725645--Resolved-Pentaho-BA-Server-Improper-Neutralization-of-Dire Vendor Advisory
https://support.pentaho.com/hc/en-us/articles/14454630725645--Resolved-Pentaho-BA-Server-Improper-Neutralization-of-Dire Vendor Advisory

Track CVE-2022-43938 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-43939Pentaho Business Analytics Server authorization bypass via non-canonical URLsHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x, makes authorization decisions using non-canon…KEVEPSS 92%analysed7.2CVE-2022-43769Hitachi Vantara Pentaho BA Server Spring Template InjectionHitachi Vantara Pentaho Business Analytics Server before 9.4.0.1 and 9.3.0.2, including 8.3.x, allows certain web services to set property values con…KEVEPSS 98%analysed8.8CVE-2022-4815Hitachi vantara pentaho deserialization of untrusted data vulnerabilityHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constr…EPSS 0.63%8.8CVE-2022-43940Hitachi vantara pentaho business analytics server incorrect authorization vulnerabilityHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization chec…EPSS 0.56%8.8CVE-2022-43773Hitachi vantara pentaho business analytics server incorrect permission assignment vulnerabilityHitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data sourc…EPSS 22%6.5CVE-2022-43941Hitachi vantara pentaho business analytics server xml external entity (xxe) vulnerabilityHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis ser…EPSS 0.53%6.5CVE-2022-43771Hitachi vantara pentaho business analytics server path traversal vulnerabilityHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes …EPSS 24%6.5CVE-2022-43772Hitachi vantara pentaho business analytics server sensitive information in log file vulnerabilityHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username a…EPSS 0.39%

Source: NIST National Vulnerability Database (record CVE-2022-43938), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.