The vulnerability of Hitachi Vantara Pentaho Business Analytics Server lies in errors during the processing of input data when performing syntactic analysis of code. This allows an attacker to execute arbitrary code.

🗓️ 12 Apr 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Hitachi Vantara Pentaho Business Analytics Server vulnerability allows arbitrary code execution during input data syntax analysis.

Reporter	Title	Published	Views	Family All 28
BDU FSTEC	The vulnerability of Hitachi Vantara Pentaho Business Analytics Server lies in improper authorization, which allows attackers to escalate their privileges.	12 Apr 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Hitachi Vantara Pentaho Business Analytics Server’s server lies in the improper limitation of XML references to external objects, which allows attackers to perform XXE attacks.	12 Apr 202300:00	–	bdu_fstec
Circl	CVE-2022-3960	3 Apr 202322:24	–	circl
Circl	CVE-2022-43940	3 Apr 202322:25	–	circl
CNNVD	Hitachi Vantara Pentaho Business Analytics Server 安全漏洞	3 Apr 202300:00	–	cnnvd
CNNVD	Hitachi Vantara Pentaho Business Analytics Server 代码问题漏洞	3 Apr 202300:00	–	cnnvd
CNNVD	Hitachi Vantara Pentaho Business Analytics Server 代码注入漏洞	3 Apr 202300:00	–	cnnvd
CVE	CVE-2022-3960	3 Apr 202318:48	–	cve
CVE	CVE-2022-43940	3 Apr 202318:25	–	cve
Cvelist	CVE-2022-3960 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')	3 Apr 202318:48	–	cvelist

Vulners

Node

hitachi,hitachi_vantara_pentaho_business_analytics_serverRange<9.4.0.1

OR

hitachi,hitachi_vantara_pentaho_business_analytics_serverRange<9.3.0.2

Source	Link
support	www.support.pentaho.com/hc/en-us/articles/14456813547917--Resolved-Pentaho-BA-Server-Improper-Neutralization-of-Directives-in-Statically-Saved-Code-Static-Code-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-CVE-2022-3960-
web	www.web.nvd.nist.gov/view/vuln/detail

28 Feb 2025 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 36.3

CVSS 26.5

EPSS0.00562

Hitachi Vantara Pentaho Business Analytics Server Remote code execution Input data processing Syntax analysis