Known vulnerabilities in Vantara Pentaho Business Analytics Server

Vendor: Hitachi
Software: Vantara Pentaho Business Analytics Server
Software CPE: cpe:2.3:a:hitachi:vantara_pentaho:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 7
Public exploits: 2
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Vantara Pentaho Business Analytics Server Vantara Pentaho Business Analytics Server is affected by 7 known vulnerabilities: 1 critical, 1 high, 1 medium, 4 low Critical High Medium Low

Vulnerabilities (7)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU105286 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-43769		 CWE-94 High
Available
Exploited
 9.3.0.2, 9.4.0.1 04.03.2025 SB2025030427
#VU105285 - Authentication Bypass Using an Alternate Path or Channel
CVE-2022-43939		 CWE-288 Critical
Available
Exploited
 9.3.0.2, 9.4.0.1 04.03.2025 SB2025030427
#VU50241 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-24664		 CWE-79 Low
No
No
 7.1.0.25, 8.2.0.6, 8.3.0.0 GA 02.02.2021 SB2021020205
#VU50237 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-24670		 CWE-79 Low
No
No
 7.1.0.25, 8.2.0.6, 8.3.0.0 GA 29.01.2021 SB2021020205
#VU50238 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-24669		 CWE-79 Low
No
No
 8.3.0.9, 9.0.0.1, 9.1.0.0 GA 29.01.2021 SB2021020205
#VU50239 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-24666		 CWE-79 Low
No
No
 9.1.0.1 29.01.2021 SB2021020205
#VU50240 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CVE-2020-24665		 CWE-776 Medium
No
No
 7.1.0.25, 8.2.0.6, 8.3.0.0 GA 29.01.2021 SB2021020205