← Vulnerability feed

Vulnerability record · CVE-2022-43941 · published 3 April 2023

CVE-2022-43941: Hitachi vantara pentaho business analytics server xml external entity (xxe) vulnerability

Hitachi · Vantara Pentaho Business Analytics Server

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference. 

6.5 CVSS 3.1 Medium EPSS 0.53% · top 57.5% CWE-611 · XML external entity (XXE)
6.5CVSS 3.1 base score
0.53%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference. 

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.pentaho.com/hc/en-us/articles/14456719346957--Resolved-Pentaho-BA-Server-Improper-Restriction-of-XML-Ext Vendor Advisory
https://support.pentaho.com/hc/en-us/articles/14456719346957--Resolved-Pentaho-BA-Server-Improper-Restriction-of-XML-Ext Vendor Advisory

Track CVE-2022-43941 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-43939Pentaho Business Analytics Server authorization bypass via non-canonical URLsHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x, makes authorization decisions using non-canon…KEVEPSS 92%analysed7.2CVE-2022-43769Hitachi Vantara Pentaho BA Server Spring Template InjectionHitachi Vantara Pentaho Business Analytics Server before 9.4.0.1 and 9.3.0.2, including 8.3.x, allows certain web services to set property values con…KEVEPSS 98%analysed8.8CVE-2022-4815Hitachi vantara pentaho deserialization of untrusted data vulnerabilityHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constr…EPSS 0.63%8.8CVE-2022-43938Hitachi vantara pentaho business analytics server code injection vulnerabilityHitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disab…EPSS 26%8.8CVE-2022-43940Hitachi vantara pentaho business analytics server incorrect authorization vulnerabilityHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization chec…EPSS 0.56%8.8CVE-2022-43773Hitachi vantara pentaho business analytics server incorrect permission assignment vulnerabilityHitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data sourc…EPSS 22%6.5CVE-2022-43771Hitachi vantara pentaho business analytics server path traversal vulnerabilityHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes …EPSS 24%6.5CVE-2022-43772Hitachi vantara pentaho business analytics server sensitive information in log file vulnerabilityHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username a…EPSS 0.39%

Source: NIST National Vulnerability Database (record CVE-2022-43941), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.