CVE-2022-4815: Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-4815?
CVE-2022-4815 is a vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x, where it deserializes untrusted JSON data without constraining the parser to approved classes and methods.
How severe is CVE-2022-4815?
CVE-2022-4815 has a severity rating of 8.8 (high).
Which versions of Hitachi Vantara Pentaho Business Analytics Server are affected by CVE-2022-4815?
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x, are affected by CVE-2022-4815.
How can I fix CVE-2022-4815?
To fix CVE-2022-4815, it is recommended to upgrade to Hitachi Vantara Pentaho Business Analytics Server version 9.4.0.1 or 9.3.0.3.
Where can I find more information about CVE-2022-4815?
More information about CVE-2022-4815 can be found in the following link: [Pentaho Support - Resolved Pentaho BA Server Deserialization of Untrusted Data](https://support.pentaho.com/hc/en-us/articles/14455879270285-IMPORTANT-Resolved-Pentaho-BA-Server-Deserialization-of-Untrusted-Data-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2022-4815-)