CVE-2022-43939 - Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability

CVE ID:CVE-2022-43939

Project:Hitachi Vantara

Product:Pentaho Business Analytics (BA) Server

Date Added:2025-03-03Due Date:2025-03-24

Vulnerability Name

Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability

Description

Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-BA-Server-Use-of-Non-Canonical-URL-Paths-for-Authorization-Decisions-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43939-

https://nvd.nist.gov/vuln/detail/CVE-2022-43939