CVE-2022-43938: Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
First published: Mon Apr 03 2023(Updated: )
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager.
Credit: security.vulnerabilities@hitachivantara.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hitachi Vantara Pentaho Business Analytics Server | <9.3.0.2 | |
| Hitachi Vantara Pentaho Business Analytics Server | =9.4.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2022-43938.
What is the severity of CVE-2022-43938?
The severity of CVE-2022-43938 is high.
What is the affected software?
The affected software is Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x.
What is the description of CVE-2022-43938?
CVE-2022-43938 is a vulnerability in Hitachi Vantara Pentaho Business Analytics Server that allows a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager.
How can I fix CVE-2022-43938?
To fix CVE-2022-43938, update Hitachi Vantara Pentaho Business Analytics Server to versions 9.4.0.1 or 9.3.0.2.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/title
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/hitachi
- canonical/hitachi vantara pentaho business analytics server
- version/hitachi vantara pentaho business analytics server/9.4.0.0