CVE-2022-43939 Hitachi Vantara Pentaho BA Server Authorization Bypass

Exploited in the wild High 8.6 Published 3 Apr 2023 Updated 21 Oct 2025

Attackers can bypass security restrictions by using non-canonical URL paths, potentially accessing unauthorized resources in Pentaho Business Analytics Server.

Exploited in the wild: Since 3 Mar 2025
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-43939?

CVE-2022-43939 is a high-severity authentication bypass vulnerability in Hitachi Vantara Pentaho Business Analytics Server, published on 3 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.

Weakness: CWE-647

Which versions are affected by CVE-2022-43939?

It affects 1 product.

Products include Hitachi Vantara Pentaho Business Analytics Server.

How do I fix CVE-2022-43939?

No fix has been published for CVE-2022-43939 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 24 Mar 2025.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-43939 being exploited?

Yes. Attackers have exploited CVE-2022-43939 in the wild since at least 3 Mar 2025.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 1 Nuclei template.

Sources

Also known as GHSA-r7cq-76xj-2g24.