CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2022-43939Public Exploit

Pentaho Business Analytics Server - Authorization Bypass (CVE-2022-43939)

PublishedApr 3, 2023
First SeenMar 17, 2025
Last Seen
Reported
CVSS8.6
Hitachi Vantara
Hitachi VantaraPentaho Business Analytics Server
enterprise_software

Description

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.

psychologyCrowdSec Analysis

CVE-2022-43939 is a vulnerability in Hitachi Vantara Pentaho Business Analytics Server which allows attackers to bypass security restrictions through specifically crafted URLs using non-canonical forms.

CrowdSec has been tracking this vulnerability and its exploits since 14th of March 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2022-43939 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Exploitation attempts generally focus on requests to URLs containing both /pentaho/api/ldap/config/ldaptreenodechildren and /require.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2023-04-03
CISA KEV2025-03-03
Rule Released2025-03-14
CrowdSec First Seen2025-03-17
CISA Remediation Deadline2025-03-24

Related Weaknesses

CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions

The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References