Historical catalog analysis: CISA added this entry on March 03, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2022-43769 is a special element injection vulnerability (CWE-74) affecting the Hitachi Vantara Pentaho Business Analytics (BA) Server. The flaw allows an attacker to inject Spring templates into properties files, which can lead to arbitrary command execution on the underlying system.
Exposure and applicability
This vulnerability applies to organizations running specific versions of the Pentaho BA Server. Based on available data, affected versions include those prior to 9.4.0.1 and 9.3.0.2, as well as version 8.3.x. Infrastructure owners should identify all instances of these versions within their environment to determine the scope of exposure.
Remediation priorities
Our analysis suggests prioritizing remediation based on the server’s network accessibility and the privileges of the account running the Pentaho service. We recommend the following actions:
- Apply Vendor Mitigations: The primary corrective action is to apply the mitigations provided by Hitachi Vantara. This should be the first priority for all identified vulnerable assets.
- Review Cloud Service Configurations: For organizations utilizing these services in a cloud environment, we suggest aligning remediation efforts with BOD 22-01 guidance to ensure consistent exposure reduction across cloud boundaries.
- Decommission Unpatchable Assets: In scenarios where vendor mitigations cannot be applied or are unavailable for a specific legacy deployment, the most effective way to eliminate the risk is to discontinue use of the product.
How to validate remediation
To verify that the exposure has been reduced, defenders should move beyond simple version checks. While confirming the installation of versions 9.4.0.1, 9.3.0.2, or later is a necessary first step, validation should include:
- Configuration Audit: Verifying that vendor-specific mitigation steps were executed according to the provided instructions, as a version update alone may not account for manual configuration requirements.
- Integrity Check: Confirming that properties files have not been modified by unauthorized entities prior to the application of the fix.
Verification is complete when there is evidence that both the software version and the associated configuration align with the vendor’s remediation requirements.
Limits and open questions
Applying these mitigations could reduce the likelihood of exploitation, but residual risk remains if the underlying system lacks hardened execution environments or strict egress filtering. It is currently unknown whether this vulnerability has been utilized in known ransomware campaigns. Additionally, while CISA has established a deadline for federal agencies, non-federal organizations must determine their own remediation timelines based on their specific risk appetite and asset criticality.
Source and editorial note
CVE-2022-43769: Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability · Source date: March 03, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: March 06, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 23, 2026 at 00:20 UTC.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗