Skip to content
Log inStart free trial

CVE-2022-43939

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs…

Critical Known exploited
Severity
9.8 / 10
Critical · CVSS 3.1
Exploit chance (EPSS)
92.27%
Chance of exploitation in the next 30 days. Higher than 99.82% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Mar 3, 2025
Weakness
CWE-647 Use of Non-Canonical URL Paths for Authorization Decisions
Fix
None yet
No fixed version published
Exploited in the wild. Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability (Hitachi Vantara Pentaho Business Analytics (BA) Server). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Mar 24, 2025.

Description

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions

The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

How to prevent it
  • Architecture and Design: Make access control policy based on path information in canonical form. Use very restrictive regular expressions to validate that the path is in the expected form.
  • Architecture and Design: Reject all alternate path encodings that are not in the expected canonical form.

References

Advisories

Exploits and evidence

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-7rc3-g7h6-22m7
File Browser: Colliding username normalization gives two users the same home directory
High Same weakness, CWE-647
GHSA-vj59-8hwv-xxmv
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
High Same weakness, CWE-647
GHSA-p688-r7jv-fm6f
Cargo can be coerced to share credentials between registries
Medium Same weakness, CWE-647
GHSA-whqg-ppgf-wp8c
Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
Medium Same weakness, CWE-647
GHSA-3rg7-wf37-54rm
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
High Same weakness, CWE-647
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor