[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2RMQFkI_Wmv92v2YiRML-HryP7dnVFdqFVwyGpCqDOo":3,"g5a-risk:CVE-2022-43939":128},{"success":4,"data":5,"meta":125},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":39,"epssPercentile":28,"epssTimeSeries":40,"severity":41,"affectedProducts":42,"affectedProductsCount":51,"references":52,"referencesCount":72,"weaknesses":73,"weaknessesCount":82,"isActivelyExploited":4,"cisaInfo":83,"otxData":28,"relatedBlogPosts":85,"seoMetadata":86,"configurations":111,"relatedVendorCves":123,"notableEvents":124},"CVE-2022-43939","What is CVE-2022-43939?","Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.","Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs...","2023-04-03T19:15:07.047","2025-10-24T14:46:22.187",9.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":37,"CVSSMetricV2":38,"CVSSMetricV40":28},[16,31],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":29,"ImpactScore":30},"security.vulnerabilities@hitachivantara.com","Secondary",{"Version":20,"VectorString":21,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":26,"BaseScore":27,"BaseSeverity":26,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"3.1","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:H","NETWORK","LOW","NONE","UNCHANGED","HIGH",8.6,null,3.9,4.7,{"Source":32,"Type":33,"CVSSData":34,"ExploitabilityScore":29,"ImpactScore":36},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":26,"IntegrityImpact":26,"AvailabilityImpact":26,"BaseScore":12,"BaseSeverity":35,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"CRITICAL",5.9,[],[],0.92266,[39,39,39,39,39,39,39],"Critical",[43,48],{"vendor":44,"product":45,"version":46,"criteria":47,"vulnerable":4},"hitachi","vantara_pentaho_business_analytics_server","*","cpe:2.3:a:hitachi:vantara_pentaho_business_analytics_server:*:*:*:*:*:*:*:*",{"vendor":44,"product":45,"version":49,"criteria":50,"vulnerable":4},"9.4.0.0","cpe:2.3:a:hitachi:vantara_pentaho_business_analytics_server:9.4.0.0:*:*:*:*:*:*:*",2,[53,58,63,65,67],{"url":54,"source":55,"tags":56},"http:\u002F\u002Fpacketstormsecurity.com\u002Ffiles\u002F172296\u002FPentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html","Packetstormsecurity",[57],"Exploit",{"url":59,"source":60,"tags":61},"https:\u002F\u002Fsupport.pentaho.com\u002Fhc\u002Fen-us\u002Farticles\u002F14455394120333--Resolved-Pentaho-BA-Server-Use-of-Non-Canonical-URL-Paths-for-Authorization-Decisions-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43939-","Pentaho",[62],"Vendor Advisory",{"url":54,"source":55,"tags":64},[57],{"url":59,"source":60,"tags":66},[62],{"url":68,"source":69,"tags":70},"https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog?field_cve=CVE-2022-43939","CISA",[71],"US Government Resource",5,[74],{"id":75,"name":76,"description":77,"extendedDescription":78,"status":79,"abstraction":80,"structure":81},"CWE-647","Use of Non-Canonical URL Paths for Authorization Decisions","The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.","If an application defines policy namespaces and makes authorization decisions based on the URL, but it does not require or convert to a canonical URL before making the authorization decision, then it opens the application to attack. For example, if the application only wants to allow access to http:\u002F\u002Fwww.example.com\u002Fmypage, then the attacker might be able to bypass this restriction using equivalent URLs such as:\nTherefore it is important to specify access control policy that is based on the path information in some canonical form with all alternate encodings rejected (which can be accomplished by a default deny rule).","Incomplete","Variant","Simple",1,{"shortDescription":84,"requiredAction":84,"vulnerabilityName":84,"dateAdded":28},"",[],{"title":87,"metaDescription":88,"keywords":89,"canonicalUrl":90,"structuredData":91},"What is CVE-2022-43939? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2022-43939, a critical severity cyber security vulnerability from 2023. High exploit probability (92.3%). Hitachi Vantara Penta...","CVE-2022-43939, CVE-2022-43939 vulnerability, CVE-2022-43939 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2023, CVSS score, exploit, patch, remediation, hitachi security, vantara_pentaho_business_analytics_server vulnerability, high risk vulnerability, actively exploited, exploit available","\u002Fwhat-is\u002Fcve-2022-43939",{"@context":92,"@type":93,"headline":87,"description":88,"datePublished":10,"dateModified":11,"author":94,"publisher":98,"about":102,"mainEntityOfPage":106,"articleSection":109,"keywords":110},"https:\u002F\u002Fschema.org","TechArticle",{"@type":95,"name":96,"url":97},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":95,"name":96,"url":97,"logo":99},{"@type":100,"url":101},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":103,"name":6,"description":104,"additionalType":105},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":107,"@id":108},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2022-43939","Cybersecurity","CVE-2022-43939, CVE-2022-43939 vulnerability, CVE-2022-43939 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[112],{"Operator":28,"Negate":28,"Nodes":113},[114],{"Operator":115,"Negate":116,"CPEMatch":117},"OR",false,[118,121],{"Vulnerable":4,"Criteria":47,"MatchCriteriaID":119,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":120,"VersionEndIncluding":28},"5D161D2B-52A5-4EF4-B7BC-0B1D823030FB","9.3.0.2",{"Vulnerable":4,"Criteria":50,"MatchCriteriaID":122,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":28,"VersionEndIncluding":28},"430B3A1E-02B7-4500-B4BA-395A873DE824",[],[],{"lastModified":11,"cacheTime":126,"version":127},1792358093514,"2.0",{"score":129,"band":41,"action":130,"scoredAt":131},90,"Emergency patch","2026-10-16T06:57:39.611776+00:00"]