CVE-2022-43941: Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference
First published: Mon Apr 03 2023(Updated: )
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference.
Credit: security.vulnerabilities@hitachivantara.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hitachi Vantara Pentaho Business Analytics Server | <9.3.0.2 | |
| Hitachi Vantara Pentaho Business Analytics Server | =9.4.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-43941?
CVE-2022-43941 is a vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x, which allows for XML External Entity Reference attacks on the Post Analysis service endpoint of the data access plugin.
How severe is the CVE-2022-43941 vulnerability?
CVE-2022-43941 has a severity rating of 6.5 (out of 10).
Which software versions are affected by CVE-2022-43941?
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x, are affected by CVE-2022-43941.
How can I protect my system from CVE-2022-43941?
To protect your system from CVE-2022-43941, update Hitachi Vantara Pentaho Business Analytics Server to version 9.4.0.1 or 9.3.0.2.
Where can I find more information about CVE-2022-43941?
More information about CVE-2022-43941 can be found at the following link: [support.pentaho.com](https://support.pentaho.com/hc/en-us/articles/14456719346957--Resolved-Pentaho-BA-Server-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-CVE-2022-43941-)
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/title
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/hitachi
- canonical/hitachi vantara pentaho business analytics server
- version/hitachi vantara pentaho business analytics server/9.4.0.0