CVE-2022-43769 Hitachi Vantara Pentaho BA Server Special Element Injection

Exploited in the wild High 8.8 Published 3 Apr 2023 Updated 21 Oct 2025

Attackers can inject Spring templates via web services to execute arbitrary code on Hitachi Vantara Pentaho Business Analytics Server.

Exploited in the wild: Since 3 Mar 2025
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-43769?

CVE-2022-43769 is a high-severity code injection vulnerability in Hitachi Vantara Pentaho Business Analytics Server, published on 3 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

Weakness: CWE-94, CWE-74

Which versions are affected by CVE-2022-43769?

It affects 1 product.

Products include Hitachi Vantara Pentaho Business Analytics Server.

How do I fix CVE-2022-43769?

No fix has been published for CVE-2022-43769 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 24 Mar 2025.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-43769 being exploited?

Yes. Attackers have exploited CVE-2022-43769 in the wild since at least 3 Mar 2025.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 1 Nuclei template.

Sources

Also known as GHSA-wc6x-gmp9-8p34.