Historical catalog analysis: CISA added this entry on March 03, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2022-43939 is an authorization bypass vulnerability affecting the Hitachi Vantara Pentaho Business Analytics (BA) Server. The flaw stems from the application’s use of non-canonical URL paths when making authorization decisions (CWE-647). This allows an attacker to potentially circumvent intended access controls by requesting resources via alternative URL paths that the server fails to normalize before verifying permissions.
Exposure and applicability
This vulnerability applies to organizations deploying Hitachi Vantara Pentaho BA Server. Based on vendor documentation, affected versions include those prior to 9.4.0.1 and 9.3.0.2, as well as the 8.3.x branch. The exposure is critical for environments where the BA Server is accessible over a network, as the bypass occurs at the URL request level.
Remediation priorities
Our analysis suggests prioritizing remediation based on the accessibility of the Pentaho instance and the sensitivity of the data it processes. We recommend the following priority sequence:
- Apply Vendor Mitigations: The primary corrective action is to update the software to a version where the non-canonical path issue is resolved, following specific vendor instructions.
- Cloud Service Review: For organizations utilizing Pentaho via cloud services, we recommend reviewing configurations in alignment with BOD 22-01 guidance to ensure provider-side mitigations are active.
- Product Decommissioning: In scenarios where the required updates cannot be applied or vendor mitigations are unavailable for a specific legacy version, the source suggests discontinuing use of the product to eliminate the exposure.
How to validate remediation
Verifying that the vulnerability is mitigated requires more than a version check. While updating to a non-vulnerable version is the first step, defenders should seek evidence that authorization decisions are now consistently applied regardless of the URL path used.
Validation should focus on confirming that requests using non-canonical variations of protected URLs (e.g., utilizing different encoding or path traversal sequences) are correctly intercepted and denied by the authorization engine. A verified result is achieved when the system demonstrates a consistent rejection of unauthorized access attempts across multiple URL formats for the same resource.
Limits and open questions
There are several limitations to consider regarding this vulnerability:
* Residual Risk: Even after patching, residual risk may exist if other components in the network stack (such as reverse proxies or load balancers) handle URL normalization differently than the application server, potentially introducing new bypass vectors.
* Exploitation Status: While included in the CISA Known Exploited Vulnerabilities catalog, it remains unknown whether this specific flaw has been utilized in ransomware campaigns.
* Verification Complexity: Because authorization bypasses often depend on the specific interaction between the web server and the application logic, a generic scan may not provide absolute assurance that all non-canonical paths are secured.
Source and editorial note
CVE-2022-43939: Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability · Source date: March 03, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: March 06, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 23, 2026 at 00:15 UTC.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗