[ CVE-2022-43769 · Published 3 Apr 2023 ]
Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2025-03-03
- EPSS: 98% chance of exploitation in the next 30 days (higher than 100% of CVEs)
[ Description ]Official description
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.
CISA: Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 24 Mar 2025): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.