# CVE-2022-43939

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.

- Page: https://www.vulneraibility.com/cve/CVE-2022-43939
- CVSS: 8.6
- Known exploited: yes, in CISA KEV since 2025-03-03; CISA due date 2025-03-24
- EPSS: 92.27%
- Public exploit code: 1 on Exploit-DB · 1 Metasploit module · 1 Nuclei template (first 2023-04-08)
- CISA SSVC: exploitation active, automatable yes, technical impact partial (assessed 2025-03-03)
- Weakness: CWE-647
- Published: 2023-04-03

## Affected versions

- Hitachi Vantara Pentaho Business Analytics Server: affected >= 1.0 and < 9.3.0.2; >= 9.4.0.0 and < 9.4.0.1

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-BA-Server-Use-of-Non-Canonical-URL-Paths-for-Authorization-Decisions-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43939-
- [other] http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-43939

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.