CVE-2022-43769

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.4.0.1 and 9.3.0.2, including 8.3.x

Description The issue is related to the incorrect neutralization of special elements in output, which can allow a remote attacker to execute arbitrary commands by injecting specially crafted Spring templates. Certain web services in the affected software allow setting property values that contain Spring templates, which are interpreted downstream.

Recommendations For versions prior to 9.4.0.1, update to version 9.4.0.1 or later. For versions prior to 9.3.0.2, update to version 9.3.0.2 or later. As a temporary workaround, consider restricting access to web services that allow setting property values with Spring templates until a patch is available.