CVE-2022-4815: Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data
First published: Wed May 24 2023(Updated: )
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods.
Credit: security.vulnerabilities@hitachivantara.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hitachi Vantara Pentaho Business Analytics Server | =9.4.0.0 | |
| Hitachi Vantara Pentaho Business Analytics Server | >=9.3.0.0<=9.3.0.3 | |
| Hitachi Vantara Pentaho | >=8.3.0.0<=8.3.0.25 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-4815?
CVE-2022-4815 is a vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x, where it deserializes untrusted JSON data without constraining the parser to approved classes and methods.
How severe is CVE-2022-4815?
CVE-2022-4815 has a severity rating of 8.8 (high).
Which versions of Hitachi Vantara Pentaho Business Analytics Server are affected by CVE-2022-4815?
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x, are affected by CVE-2022-4815.
How can I fix CVE-2022-4815?
To fix CVE-2022-4815, it is recommended to upgrade to Hitachi Vantara Pentaho Business Analytics Server version 9.4.0.1 or 9.3.0.3.
Where can I find more information about CVE-2022-4815?
More information about CVE-2022-4815 can be found in the following link: [Pentaho Support - Resolved Pentaho BA Server Deserialization of Untrusted Data](https://support.pentaho.com/hc/en-us/articles/14455879270285-IMPORTANT-Resolved-Pentaho-BA-Server-Deserialization-of-Untrusted-Data-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2022-4815-)
- collector/nvd-latest
- vendor/hitachi
- vendor/vantara pentaho business analytics server
- vendor/vantara pentaho
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/references
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- canonical/hitachi vantara pentaho business analytics server
- version/hitachi vantara pentaho business analytics server/9.4.0.0
- version/hitachi vantara pentaho business analytics server/9.3.0.0
- version/hitachi vantara pentaho business analytics server/9.3.0.3
- canonical/hitachi vantara pentaho
- version/hitachi vantara pentaho/8.3.0.0
- version/hitachi vantara pentaho/8.3.0.25