Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.

Hitachi Pentaho Business Analytics Server versions 8.3.x prior to 9.3.0.2 or 9.4.x prior to 9.4.0.1 suffer from a remote code execution vulnerability. An attacker can exploit this issue by sending a specially crafted HTTP request to the affected application. A successful exploit could allow the attacker to execute arbitrary code on the target system.

Pentaho Business Server versions prior to 9.4.0.1 / 9.3.0.2 contain security restrictions using non-canonical URLs that can be bypassed. This bypass may be associated with a vulnerability allowing certain Web services to define property values containing Spring templates which are then interpreted (Server-Side Template Injection).

ID	Name	Product	Family	Type	Severity
114985	Hitachi Pentaho Business Analytics Server 8.3.x < 9.3.0.2 / 9.4.x < 9.4.0.1 Remote Code Execution	Web App Scanning	Component Vulnerability	Check Based	critical
114248	Pentaho Business Server Server-Side Template Injection	Web App Scanning	Component Vulnerability	Check Based	high

Detections

Analytics

CVE-2022-43939

critical

Tenable Plugins

critical

high