CVE-2022-43939

KEV
Published: Apr 03, 2023 Last Modified: Ott 24, 2025
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,6
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: high

Description

AI Translation Available

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,9379
Percentile
1,0th
Updated

EPSS Score Trend (Last 90 Days)

647

Use of Non-Canonical URL Paths for Authorization Decisions

Incomplete
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Confidentiality
Potential Impacts:
Bypass Protection Mechanism Read Files Or Directories
Applicable Platforms
Technologies: Web Server
Likelihood of Exploit: High
View CWE Details
Exploit

Pentaho BA Server EE 9.3.0.0-428 - Remote Code …

Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)

Author: dwbzn Published:
View Exploit Code →
Application

Vantara Pentaho Business Analytics Server by Hitachi

Product Information
Vendor Hitachi
Product Vantara Pentaho Business Analytics Server
Version 9.4.0.0
cpe:2.3:a:hitachi:vantara_pentaho_business_analytics_server:9.4.0.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Vantara Pentaho Business Analytics Server by Hitachi

Product Information
Vendor Hitachi
Product Vantara Pentaho Business Analytics Server
Version Range Affected
To 9.3.0.2 (exclusive)
cpe:2.3:a:hitachi:vantara_pentaho_business_analytics_server:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.cisa.gov/known-exploited-vulnerabilities-catalo…
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022…
http://packetstormsecurity.com/files/172296/Pentaho-Busines…
http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authenticat…
https://support.pentaho.com/hc/en-us/articles/1445539412033…
https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-…
http://packetstormsecurity.com/files/172296/Pentaho-Busines…
http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authenticat…
https://support.pentaho.com/hc/en-us/articles/1445539412033…
https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-…