Name: CVE-2022-43769: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Published: 2023-04-03T00:00:00.000Z
Keywords: CVE, CVE-2022-43769, CWE-74, CWE-94, Exploited in the Wild, CISA KEV Exploit, Metasploit Module, CVSS 8.8, EPSS 0.9767, CISA KEV

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

CVSS Details

CVSS 3.1 Base Score: 8.8
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Hitachi Vantara Pentaho Business Analytics Server	View advisory ↗View advisory ↗	hitachi-vantara-pentaho-upgrade-latest	May 1, 2025	Apr 3, 2023

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub