ID:11187 - Exploit for Code Injection in Vantara Pentaho Business Analytics Server - CVE-2022-43769

Link to public exploit:

Vulnerability description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote authenticated user can inject Spring templates into properties files and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation