Vulnerability detail

Enriched intelligence for a single CVE

8.8

CVSS
High

CVE-2022-43769

PUBLISHED

Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Exploited in the wild Remote Low complexity No user interaction

Vendor: Hitachi Vantara
Product: Pentaho Business Analytics Server
Published: Apr 03, 2023
EPSS: —

Description

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

java cisa nuclei_scanner metasploit nessus_scanner

CVSS scores

CVSS v3.1 8.8 High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation status

Exploited in the wild

Recorded 2025-03-03 00:00:00 UTC · Source

SSVC decision points

Exploitation: active
Automatable: No
Technical impact: total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source	Added
CISA	Mar 03, 2025

Scanner integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/pentaho_business_server_authbypass_and_ssti.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43769.yaml	Apr 25, 2025

Timeline

CVE ID Reserved

October 26, 2022
CVE Published to Public

April 03, 2023
Added to KEVIntel

March 03, 2025
Detected by Nuclei

April 25, 2025
Detected by Metasploit

April 28, 2025