Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2022-43939

CVE-2022-43939HIGH

Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  L  H    8.6   .9227   99.8   YES

AFFECTED
  Product                            Versions  Fixed
  Pentaho Business Analytics Server  1.0 –     —

TIMELINE
  Oct 26  Reserved by HITVAN
  Apr 3   Published (CNA: HITVAN)
  Mar 3   Added to CISA KEV, remediation due 2025-03-24

CWE-647 · CNA: HITVAN · CVSS v3.1 · 3 references · KEV due March 24, 2025

Description

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
October 26, 2022	Reserved	Reserved by HITVAN
April 3, 2023	Published	Published (CNA: HITVAN)
March 3, 2025	KEV ADDED	Added to CISA KEV, remediation due 2025-03-24

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Hitachi Vantara	Pentaho Business Analytics Server	—	1.0	—

Weaknesses

CWE-647

References (3)

Authoritative record: CVE-2022-43939 at cve.org

Vendors: hitachi vantara

Weaknesses: CWE-647

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-43939 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.