March 3, 2025 · Applied Cybernetics Group
CVE-2022-43769 — Hitachi Vantara Pentaho Business Analytics (BA) Server
Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
- Added to KEV
2025-03-03- Federal due date
2025-03-24- Vendor
- Hitachi Vantara
- Product
- Pentaho Business Analytics (BA) Server
- EPSS
- 99.9th percentile (score 0.940, as of
2026-06-08) - NVD CVSS v3.1
- —
- Ransomware use
- Unknown
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2022-43769
CISA short description
Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.