CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2023-04-03
Hitachi Vantara Pentaho Business Analytics Server Non-Canonical URL Path Authorization Bypass and RCE (CVE-2022-43939)
[Affected Scope] Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x
[Impact] Unauthenticated attackers can bypass security restrictions to gain administrative access and chain it with Server-Side Template Injection (SSTI) to execute arbitrary code
[Mitigation] Immediately upgrade to patched versions (9.4.0.1, 9.3.0.2 or later) and restrict external access to the Pentaho management interface