CVE-2022-43941: Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-43941?
CVE-2022-43941 is a vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x, which allows for XML External Entity Reference attacks on the Post Analysis service endpoint of the data access plugin.
How severe is the CVE-2022-43941 vulnerability?
CVE-2022-43941 has a severity rating of 6.5 (out of 10).
Which software versions are affected by CVE-2022-43941?
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x, are affected by CVE-2022-43941.
How can I protect my system from CVE-2022-43941?
To protect your system from CVE-2022-43941, update Hitachi Vantara Pentaho Business Analytics Server to version 9.4.0.1 or 9.3.0.2.
Where can I find more information about CVE-2022-43941?
More information about CVE-2022-43941 can be found at the following link: [support.pentaho.com](https://support.pentaho.com/hc/en-us/articles/14456719346957--Resolved-Pentaho-BA-Server-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-CVE-2022-43941-)