{"id":"CVE-2022-43769","kind":"vulnerability","aliases":["CVE-2022-43769"],"related":[],"title":"Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow…","description":"Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Hitachi Vantara Pentaho Business Analytics Server contains a special element injection flaw that lets an attacker inject Spring templates into properties files. The injected templates lead to arbitrary command execution on the server.","severity":"critical","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2025-03-03T00:00:00+00:00","products":[{"name":"Hitachi Vantara Pentaho Business Analytics (BA) Server","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"hitachi vantara pentaho business analytics server","fixed":["9.3.0.2"],"affected":">= 8.3.0.0, < 9.3.0.2","ecosystem":"vendor"},{"name":"hitachi vantara pentaho business analytics server","fixed":[],"affected":"= 9.4.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["business-analytics","exploited","java","pentaho","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor mitigations per Hitachi Vantara instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action). Specific fixed version: unknown","status":"open","published_at":"2023-04-03T18:15:07+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:52:19+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T20:52:19Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations per Hitachi Vantara instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action). Specific fixed version: unknown","reach":"unknown","impact":"high","summary":"Hitachi Vantara Pentaho Business Analytics Server contains a special element injection flaw that lets an attacker inject Spring templates into properties files. The injected templates lead to arbitrary command execution on the server.","category":"vendor","who_cares":["pentaho","business-analytics","java","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the Pentaho BA server","analyst_note":"Exploited in the wild per CISA KEV; find the Hitachi Vantara advisory for affected versions, fixed version, and the exact vendor mitigation steps and detection indicators.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000463,"input_tokens":2700,"output_tokens":387,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':124C '-2022':18A,21A '-43769':19A,22A '22':123C '8.3':14A '9.3.0.2':12A '9.4.0.1':10A 'action':114C 'allow':16A,97C,107C 'analyt':5A,44B,56B 'analytics':27A,34A,40A 'appli':115C 'applic':121C 'arbitrari':79B,109C 'attack':67B,99C 'ba':28A,88C 'bod':122C 'busi':4A,43B,55B 'business':26A,33A,39A 'business-analyt':42B 'cisa':112C 'cloud':127C 'command':80B,110C 'contain':58B,90C 'cve':17A,20A 'discontinu':130C 'element':61B,93C 'execut':81B,111C 'exploit':45B 'file':73B,106C 'flaw':63B 'follow':120C 'guidanc':125C 'hitachi':1A,23A,30A,36A,52B,85C 'host':50B 'includ':13A 'inject':62B,68B,75B,94C,101C 'instruct':119C 'java':46B 'lead':77B 'let':65B 'mitig':116C,136C 'pentaho':3A,25A,32A,38A,47B,54B,87C 'per':117C 'prior':7A 'product':134C 'properti':72B,105C 'requir':113C 'self':49B 'self-host':48B 'server':6A,29A,35A,41A,57B,84B,89C 'servic':128C 'special':60B,92C 'spring':69B,102C 'templat':70B,76B,103C 'unavail':138C 'use':131C 'vantara':2A,24A,31A,37A,53B,86C 'vendor':51B,118C 'version':9A 'vulner':95C 'x':15A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-04-03T18:15:07+00:00","kev":{"dateAdded":"2025-03-03","dueDate":"2025-03-24","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security.vulnerabilities@hitachivantara.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-43769","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-43769","severity":null,"published_at":"2025-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-43769","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43769","severity":null,"published_at":"2023-04-03T18:15:07+00:00","modified_at":"2026-06-17T05:07:17+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}