WaratekVRT Sign in

CVE-2022-43769 Hitachi Vantara Pentaho Business Analytics Server

Affected softwareHitachi Vantara Pentaho Business Analytics Server
Severity8.8 High CVSS 3.1 2 scores
WeaknessCode injection (CWE-94)
Published3 Apr 2023
Updated29 Sep 2026

Description

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

CWE-74

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2025-03-03 · remediation due 2025-03-24 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 4 citations · 1 exploit · earliest 2025-03-03.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
  • Indexed PoC 3 indexed Published artifacts you can open, in Exploit-DB, Metasploit, Nuclei; first seen 2023-04-08.
  • EPSS 98% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2022-43769 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2025-03-03
Reported exploitation greynoise.io /blog/greynoise-observes-exploitation-three-newly-added-kev-vulnerabilities 2025-03-04
Reported exploitation isc.sans.edu /diary/rss/32518 2025-11-24
Reported exploitation loginsoft.com /reports/annually/vulnerability-intelligence-report-2025 2026-01-20
Exploit reference VulnCheck XDB ee3a42a38210 Exploit type: initial-access 2023-12-20
IndexArtifactStarsFirst seen
Exploit-DB Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated) 2023-04-08
Nuclei Hitachi Pentaho Business Analytics Server - Remote Code Execution
Metasploit Pentaho Business Server Auth Bypass and Server Side Template Injection RCE (excellent rank)

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Process rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: ARMR Process rule

SpEL template injection via the ldapTreeNodeChildren url parameter; the Process rule (with /bin/*, cmd.exe and powershell.exe listed) blocks the T(java.lang.Runtime).getRuntime().exec() fork every public exploit uses. An expression that reads files or data directly in Java, without starting a program, is not stopped.

How to mitigate CVE-2022-43769

Apply the vendor's fix for Hitachi Vantara Pentaho Business Analytics Server. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

8.8 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H security.vulnerabilities@hitachivantara.com Secondary published
CVSS 3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H NVD Primary

Affected software and releases

Products and versions

1 product, 2 version entries
SourceVendorProductSchemeAffected versions
nvd hitachi vantara pentaho business analytics server generic ≥ 8.3.0.0 and ＜ 9.3.0.2 · 9.4.0.0

References

URLTags
https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769
http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html Exploit
https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769- Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-43769 US Government Resource

Timeline
Published2023-04-03By the CVE Program.
Added to CISA KEV2025-03-03Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: earliest evidence2025-03-03Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
VulnCheck KEV: latest evidence2026-01-20Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Last VRT activity2026-09-29Most recent commit touching this CVE's classification, patch or rule file.
Classification created2026-11-13First commit adding this CVE's research note.