[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmDLJzq-YUJhUpdtNEhUzzymjOevMv54NKt9MV-vEwJo":3,"g5a-family:hitachi\u002Fvantara_pentaho_business_analytics_server":112,"g5a-ex:hitachi\u002Fvantara_pentaho_business_analytics_server@*":113},{"success":4,"data":5},true,{"product":6,"versions":26,"topVulnerabilitiesByEpss":31,"kevVulnerabilities":81,"seoMetadata":90,"meta":109},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":25},"hitachi","vantara_pentaho_business_analytics_server",4,14,2,"2023-05-24",[14,18,20,23],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"8.3.0.0",0,false,{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},"9.3.0.2",{"version":21,"cve_count":22,"kev_count":11,"has_kev":4},"9.4.0.0",10,{"version":24,"cve_count":16,"kev_count":16,"has_kev":17},"9.4.0.1","Vantara Pentaho Business Analytics Server by Hitachi is a technology product with 4 tracked versions and 14 known security vulnerabilities including 2 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[27,28,29,30],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},{"version":21,"cve_count":22,"kev_count":11,"has_kev":4},{"version":24,"cve_count":16,"kev_count":16,"has_kev":17},[32,40,45,49,55,59,63,67,71,76],{"cveId":33,"description":34,"publishedDate":35,"cvssScore":36,"cvssVersion":37,"severity":38,"isKev":4,"epssScore":39},"CVE-2022-43769","Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.","2023-04-03",8.8,"v3.1","High",0.9767,{"cveId":41,"description":42,"publishedDate":35,"cvssScore":43,"cvssVersion":37,"severity":38,"isKev":4,"epssScore":44},"CVE-2022-43939","Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.",8.6,0.92266,{"cveId":46,"description":47,"publishedDate":35,"cvssScore":36,"cvssVersion":37,"severity":38,"isKev":17,"epssScore":48},"CVE-2022-43938","\nHitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager. \n\n",0.26436,{"cveId":50,"description":51,"publishedDate":35,"cvssScore":52,"cvssVersion":37,"severity":53,"isKev":17,"epssScore":54},"CVE-2022-43771","\nHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds.  \n\n",6.5,"Medium",0.23894,{"cveId":56,"description":57,"publishedDate":35,"cvssScore":36,"cvssVersion":37,"severity":38,"isKev":17,"epssScore":58},"CVE-2022-43773","\nHitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configured with stored procedures enabled. \n\n",0.22179,{"cveId":60,"description":61,"publishedDate":12,"cvssScore":36,"cvssVersion":37,"severity":38,"isKev":17,"epssScore":62},"CVE-2022-4815","\nHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods. \n\n",0.00628,{"cveId":64,"description":65,"publishedDate":35,"cvssScore":36,"cvssVersion":37,"severity":38,"isKev":17,"epssScore":66},"CVE-2022-43940","\nHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the data source management service. \n\n",0.00555,{"cveId":68,"description":69,"publishedDate":35,"cvssScore":52,"cvssVersion":37,"severity":53,"isKev":17,"epssScore":70},"CVE-2022-43941","\nHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference. \n\n",0.0053,{"cveId":72,"description":73,"publishedDate":35,"cvssScore":74,"cvssVersion":37,"severity":53,"isKev":17,"epssScore":75},"CVE-2022-3960","\nHitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin. \n\n",6.3,0.00453,{"cveId":77,"description":78,"publishedDate":35,"cvssScore":79,"cvssVersion":37,"severity":53,"isKev":17,"epssScore":80},"CVE-2022-4769","\nHitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploaded with an invalid character in its name. \n\n",4.3,0.00435,[82,87],{"cveId":33,"description":34,"publishedDate":35,"cvssScore":36,"severity":38,"isKev":4,"epssScore":39,"cisaVulnName":83,"cisaDateAdded":84,"cisaShortDescription":85,"cisaRequiredAction":86},"Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability","2025-03-03","Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":41,"description":42,"publishedDate":35,"cvssScore":43,"severity":38,"isKev":4,"epssScore":44,"cisaVulnName":88,"cisaDateAdded":84,"cisaShortDescription":89,"cisaRequiredAction":86},"Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability","Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization.",{"title":91,"metaDescription":92,"keywords":93,"structuredData":94},"Vantara Pentaho Business Analytics Server by Hitachi - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Vantara Pentaho Business Analytics Server by Hitachi covering 4 versions with 14 tracked vulnerabilities including 0 critical and 2 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Vantara Pentaho Business Analytics Server vulnerabilities, Vantara Pentaho Business Analytics Server security, Vantara Pentaho Business Analytics Server CVE, Hitachi Vantara Pentaho Business Analytics Server, Vantara Pentaho Business Analytics Server threat intelligence, Hitachi security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Vantara Pentaho Business Analytics Server KEV, Vantara Pentaho Business Analytics Server exploited vulnerabilities",{"@context":95,"@type":96,"name":97,"description":92,"url":98,"manufacturer":99,"applicationCategory":103,"softwareVersion":104,"mainEntity":105},"https:\u002F\u002Fschema.org","SoftwareApplication","Vantara Pentaho Business Analytics Server","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fhitachi\u002Fvantara_pentaho_business_analytics_server",{"@type":100,"name":101,"url":102},"Organization","Hitachi","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fhitachi","Security Software","4 versions tracked",{"@type":106,"name":107,"description":108,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Vantara Pentaho Business Analytics Server Security Vulnerabilities","Security vulnerabilities affecting Vantara Pentaho Business Analytics Server by Hitachi",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":110,"apiVersion":111},"2026-10-18T21:15:36.872Z","3.0",[],{"rows":114,"total":11,"capped":17,"failed":16},[115,120],{"cveId":33,"name":83,"severity":38,"cvss":36,"added":84,"epss":39,"published":116,"ranges":117,"checked":4,"hits":119,"covers":17},"2023-04-03T18:15:07.703",[118,21],"8.3.0.0 to before 9.3.0.2",[],{"cveId":41,"name":88,"severity":38,"cvss":43,"added":84,"epss":44,"published":121,"ranges":122,"checked":4,"hits":124,"covers":17},"2023-04-03T19:15:07.047",[123,21],"before 9.3.0.2",[]]