{"id":"CVE-2022-43769","published":"2023-04-03T18:15:07Z","modified":"2026-06-17T05:07:17Z","title":"Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability","vendor":"Hitachi Vantara","product":"Pentaho Business Analytics (BA) Server","tier":"core","eol":null,"description":{"text":"Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a special element injection vulnerability in the web services of Hitachi Vantara's Pentaho Business Analytics (BA) Server, which allows property values to contain Spring templates that are later interpreted downstream. An attacker with high-privilege authentication and network access can exploit this by supplying crafted property values through those web services, and the affected versions are those prior to 9.4.0.1 and 9.3.0.2, including 8.3.x.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:09Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.9767,"percentile":0.99903,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-03-03","dueDate":"2025-03-24","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769 ; https://nvd.nist.gov/vuln/detail/CVE-2022-43769","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-03-03","exploitedFirstSeen":"2025-03-03","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-03-03"},{"url":"https://www.greynoise.io/blog/greynoise-observes-exploitation-three-newly-added-kev-vulnerabilities","date":"2025-03-04"},{"url":"https://isc.sans.edu/diary/rss/32518","date":"2025-11-24"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"},{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component"}],"references":[{"url":"http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html","tags":["Exploit"]},{"url":"https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769-","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html","tags":["Exploit"]},{"url":"https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769-","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-43769","tags":["US Government Resource"]}],"techniques":[{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Injection","mappingType":"exploitation_technique","evidence":[],"comment":"Attackers can use Server-Side Template Injection with a Thymeleaf template to inject malicious code.. When chained with CVE-2022-43939, can lead to unauthorized code execution.","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Injection","mappingType":"primary_impact","evidence":[],"comment":"Attackers can use Server-Side Template Injection with a Thymeleaf template to inject malicious code.. When chained with CVE-2022-43939, can lead to unauthorized code execution.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-46739","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46739","exploited":true,"exploitedSince":"2025-03-03","provenance":"source"},"exploits":[{"id":51350,"url":"https://www.exploit-db.com/exploits/51350","title":"Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)","type":"webapps","platform":"jsp","date":"2023-04-08","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2023-04-08"},"metasploit":[{"name":"Pentaho Business Server Auth Bypass and Server Side Template Injection RCE","module":"exploit/multi/http/pentaho_business_server_authbypass_and_ssti","type":"exploit","disclosureDate":"2023-04-04","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/pentaho_business_server_authbypass_and_ssti.rb"}],"nuclei":[{"id":"CVE-2022-43769","name":"Hitachi Pentaho Business Analytics Server - Remote Code Execution","severity":"high","path":"http/cves/2022/CVE-2022-43769.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43769.yaml"}],"first":{"date":"2023-04-04","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/pentaho_business_server_authbypass_and_ssti.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html"],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2023-04-03","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43769","provenance":"source"},{"date":"2023-04-04","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2023-04-08","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/pentaho_business_server_authbypass_and_ssti.rb","provenance":"source"},{"date":"2025-03-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2025-03-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46739","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"Metasploit","daysToKev":700},"priority":{"score":68.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 607 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9990"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}