CVE-2022-43769 - Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

Hitachi Vantara | Pentaho Business Analytics (BA) Server

• Date Added:
• 2025-03-03

• Due Date:
• 2025-03-24

Vulnerability Name

Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

Description

Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769 ; https://nvd.nist.gov/vuln/detail/CVE-2022-43769

Top Security News

Microsoft confirms it's killing off Skype in May, after 14 years

Data Leak Exposes TopSec's Role in China's Censorship-as-a-Service Operations

U.S. recovers $31 million stolen in 2021 Uranium Finance hack

EncryptHub breaches 618 orgs to deploy infostealers, ransomware

MITRE Caldera RCE vulnerability with public PoC fixed, patch ASAP! (CVE-2025–27364)

Mozilla Updates Firefox Terms Again After Backlash Over Broad Data License Language

Vo1d Botnet's Peak Surpasses 1.59M Infected Android TVs, Spanning 226 Countries

Siemens Teamcenter vulnerability could allow account takeover (CVE-2025-23363)

Common Alerts

HighSQL Injection - SQLite

MediumApplication Error Disclosure via WebSockets

LowStrict-Transport-Security Malformed Content (Non-compliant with Spec)

LowPermissions Policy Header Not Set

HighServer Side Code Injection - PHP Code Injection

MediumInteger Overflow Error

LowX-Backend-Server Header Information Leak

InformationalBase64 Disclosure in WebSocket message

MediumHTTPS to HTTP Insecure Transition in Form Post

InformationalImage Exposes Location or Privacy Data

Top CVE List

CVE-2024-49035 Microsoft Partner Center Improper Access Control Vulnerability

CVE-2023-34192 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

CVE-2024-20953 Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

CVE-2025-24989 Microsoft Power Pages Improper Access Control Vulnerability

CVE-2017-0148 Microsoft SMBv1 Server Remote Code Execution Vulnerability

CVE-2017-6736 Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

CVE-2025-0108 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

CVE-2017-3881 Cisco IOS and IOS XE Remote Code Execution Vulnerability

CVE-2020-29574 CyberoamOS (CROS) SQL Injection Vulnerability

CVE-2024-44308 Apple Multiple Products Code Execution Vulnerability

Top CWE List

CWE-693 Protection Mechanism Failure

HighCWE-200 Exposure of Sensitive Information to an Unauthorized Actor

HighCWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-1426 Improper Validation of Generative AI Output

CWE-581 Object Model Violation: Just One of Equals and Hashcode Defined

CWE-201 Insertion of Sensitive Information Into Sent Data

CWE-1193 Power-On of Untrusted Execution Core Before Enabling Fabric Access Control

CWE-1298 Hardware Logic Contains Race Conditions

CWE-1125 Excessive Attack Surface

CWE-1189 Improper Isolation of Shared Resources on System-on-a-Chip (SoC)