Lucene search

PRIOn knowledge basePRION:CVE-2022-43769

HistoryApr 03, 2023 - 6:15 p.m.

Design/Logic Flaw

2023-04-0318:15:00

PRIOn knowledge base

www.prio-n.com

hitachi vantara

pentaho business analytics

server

vulnerability

injection

spring templates

8.1 High

AI Score

Confidence

High

0.562 Medium

EPSS

Percentile

97.7%

JSON

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

CPENameOperatorVersion
vantara_pentaho_business_analytics_servereq9.4.0.0
vantara_pentaho_business_analytics_serverge8.3.0.0
vantara_pentaho_business_analytics_serverlt9.3.0.2

Name	Operator	Version
vantara_pentaho_business_analytics_server	eq	9.4.0.0
vantara_pentaho_business_analytics_server	ge	8.3.0.0
vantara_pentaho_business_analytics_server	lt	9.3.0.2

References

packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html

support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769-